CVE-2026-43022

A flaw was found in the Bluetooth Host Controller Interface (HCI) synchronization component of the Linux kernel. The hci_cmd_sync_queue_once() function did not properly signal when a command was already queued, which could lead to resource leaks. An attacker could potentially exploit this to cause a Denial of Service by exhausting system resources.

A Moderate flaw was found in the Bluetooth Host Controller Interface (HCI) synchronization component of the Linux kernel. This issue could allow a local attacker to cause a Denial of Service by exhausting system resources due to improper handling of queued commands. Exploitation requires local access to the system or specific Bluetooth capabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the Bluetooth service on affected systems if it is not required. This prevents the vulnerable code path from being exercised.

To disable the Bluetooth service:

sudo systemctl stop bluetooth
sudo systemctl disable bluetooth

Note that disabling the Bluetooth service will prevent all Bluetooth functionality on the system. A system reboot may be required for the changes to take full effect.