What’s Vulnerable › Vulnerabilities

CVE-2022-26878

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-03-11 · updated 2026-10-08
• Weakness: CWE-401

Description

drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).

Affected products

• Linux kernel: from 5.13 before 5.15.17; from 5.16 before 5.16.3 — fixed in 5.15.17, 5.16.3

How to fix

Upgrade to a fixed version: Linux kernel 5.15.17, 5.16.3. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2022/03/11/1
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.17
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1d0688421449718c6c5f46e458a378c9b530ba18
• https://lore.kernel.org/linux-bluetooth/1A203F5E-FB5E-430C-BEA3-86B191D69D58%40holtmann.org/
• http://www.openwall.com/lists/oss-security/2022/03/11/1
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.17
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.3
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1d0688421449718c6c5f46e458a378c9b530ba18
• https://lore.kernel.org/linux-bluetooth/1A203F5E-FB5E-430C-BEA3-86B191D69D58%40holtmann.org/

Get alerted when CVE-2022-26878 or the next vulnerability affects your stack