Service interruption via unreleased sent command buffer

Memory leak in Linux kernel Bluetooth hci_core allows local users to exhaust kernel memory and interrupt service by releasing an HCI device. The hci_release_dev path frees the hci_dev object without first freeing its sent_cmd socket buffer, leaving the stored command allocation and contents resident. Repeated teardown of affected Bluetooth HCI devices can accumulate unreclaimed kernel memory; the published assessment limits reachability to a local low-privileged user and impact to availability.