CVE-2026-90254
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths adv_timeout_expire() hands a kmalloc()ed instance byte to hci_cmd_sync_queue() with a NULL destroy callback, and only adv_timeout_expire_sync() frees it. That leaks on two paths: - the return value is not checked, and hci_cmd_sync_queue() does not take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM); - a cancelled entry is not released, as _hci_cmd_sync_cancel_entry() does not free entry->data when there is no destroy callback. hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Free the buffer from a destroy callback, and in the caller when the entry could not be queued at all.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| c249ea9b4309cf3250c5bbb42a05d38d0ed9071c | affected | git | c2019224a766245b7db39d87fdfe84c3fdc879d9 | Unavailable | None listed |
| c249ea9b4309cf3250c5bbb42a05d38d0ed9071c | affected | git | 193182c6467f508a8a61d5db506d796ffed6eee6 | Unavailable | None listed |
| c249ea9b4309cf3250c5bbb42a05d38d0ed9071c | affected | git | 2e3d827cd56865c14f6ca118bbccd7801091fb21 | Unavailable | None listed |
| c249ea9b4309cf3250c5bbb42a05d38d0ed9071c | affected | git | 9c3b6c1413bd0b4993642d987616331f84d9b7f5 | Unavailable | None listed |
| c249ea9b4309cf3250c5bbb42a05d38d0ed9071c | affected | git | bb5ca1cc7744c41c59002bd6523714a685ae6595 | Unavailable | None listed |
| c249ea9b4309cf3250c5bbb42a05d38d0ed9071c | affected | git | 120d8dc042e3d45073bb6e50ee7b058a0b182627 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.1 | Unavailable | None listed |
| 6.1.188 | unaffected | semver | Unavailable | 6.1.* | None listed |
| 6.6.157 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.110 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.52 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 7.2.6 | unaffected | semver | Unavailable | 7.2.* | None listed |
| 7.3 | unaffected | original_commit_for_fix | Unavailable | * | None listed |