---
id: CVE-2026-43021
title: 'Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails

  When hci_cmd_sync_queue_once() returns with error, the destroy callback
  will not be called.

  Fix leak…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a106e50be74b0896583f4d010a69f9806e4194f4 <
    7fd74178d4b16dcf47179da634ea9d7c02e3608b
  - >-
    Linux >= a106e50be74b0896583f4d010a69f9806e4194f4 <
    aca377208e7f7322bf4e107cdec6e7d7e8aa7a88
  - Linux 6.19
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:26:08.758364Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:26.573Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43021'
references:
  - url: 'https://git.kernel.org/stable/c/7fd74178d4b16dcf47179da634ea9d7c02e3608b'
  - url: 'https://git.kernel.org/stable/c/aca377208e7f7322bf4e107cdec6e7d7e8aa7a88'
tags:
  - cve.org
epss: 0.00107
epssPercentile: 0.01157
ingestedAt: '2026-11-06T15:54:04.035Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails

When hci_cmd_sync_queue_once() returns with error, the destroy callback
will not be called.

Fix leaking references / memory on these failures.

## Affected

- `Linux >= a106e50be74b0896583f4d010a69f9806e4194f4 < 7fd74178d4b16dcf47179da634ea9d7c02e3608b`
- `Linux >= a106e50be74b0896583f4d010a69f9806e4194f4 < aca377208e7f7322bf4e107cdec6e7d7e8aa7a88`
- `Linux 6.19`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.