A memory leak in the Bluetooth management subsystem occurs when SSP (Secure Simple Pairing) completion callbacks fail to free allocated pending command structures. Each completed SSP command retains a mgmt_pending_cmd object and its parameters, consuming kernel memory until the system shuts down. While the CVE does not provide code execution or privilege escalation, the accumulation of unreleased memory can degrade system responsiveness and potentially lead to a device‑wide denial of service if the leak is sufficiently abused, especially on resource‑constrained embedded devices.

All Linux kernel installations that include the vulnerable Bluetooth management code and have not applied the patch with commit 302a1f674c00. This includes kernel releases up to and including 6.19 RC7. The vulnerability is tied to the Bluetooth subsystem in the mainline Linux kernel, affecting any system that enables the Bluetooth MGMT module or processes SSP requests.

The CVSS score of 5.5 indicates a medium severity and the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires an attacker’s ability to send a large number of SSP completion triggers to the host, which is possible for devices with a public or exposed Bluetooth interface. Given that the issue leads only to memory exhaustion and not immediate corruption or code execution, the risk is moderate but not negligible for environments that rely on continuous Bluetooth service availability.