CVE-2026-53364 describes a memory leak in the Linux kernel Bluetooth component within the hci_le_big_terminate() function. The function allocates memory for iso_list_data using kzalloc_obj but returns early without freeing this memory when neither pa_sync_term nor big_sync_term flags are set after evaluating PA and BIG sync connection states. This early return path was introduced during a refactor to use struct hci_conn instead of raw parameters, and the existing kfree() call does not cover this case, resulting in a memory leak (CWE-401).

The vulnerability causes a memory leak in the Bluetooth subsystem of the Linux kernel, potentially leading to resource exhaustion and degraded system performance or stability. There is no indication of confidentiality or integrity impact. The CVSS vector indicates local attack complexity is low, privileges required are low, no user interaction is needed, and the impact is on availability only.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or vendor advisories are provided, users should monitor official Linux kernel security channels for updates addressing this memory leak. Until a fix is available, limiting Bluetooth usage or disabling Bluetooth if not needed may reduce exposure.