CVE-2026-53252 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and take necessary steps to mitigate it. This includes reviewing kernel configurations and ensuring the latest kernel version is running. Additionally, defenders should prioritize patching and monitoring for potential exploitation attempts.

Technical summary

The vulnerability occurs in the Linux kernel's Bluetooth HCI UART configuration. When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev). Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory. The fix involves explicitly calling cleanup_srcu_struct() in the fallback branch of bt_host_release() before freeing the device.

Defensive priority

High priority should be given to patching this vulnerability, as it could potentially be exploited to cause memory leaks and disrupt system operations. Defenders should prioritize patching and monitoring for potential exploitation attempts.

Recommended defensive actions

• Review and update Linux kernel configurations to ensure the latest kernel version is running.
• Prioritize patching and monitoring for potential exploitation attempts.
• Implement compensating controls to detect and prevent potential exploitation.
• Monitor system operations for signs of memory leaks or disruptions.
• Perform regular vulnerability assessments and penetration testing to identify potential weaknesses.

Evidence notes

The vulnerability has been resolved in the Linux kernel, and the fix involves explicitly calling cleanup_srcu_struct() in the fallback branch of bt_host_release() before freeing the device. The CVE record and NVD detail provide additional information on the vulnerability.

Official resources