CVE-2026-90254Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths adv_timeout_expire() hands a kmalloc()ed instance byte to hci_cmd_sync_queue() with a NULL destroy callback, and only adv_timeout_expire_sync() frees it. That leaks on two paths: - the return value is not checked, and hci_cmd_sync_queue() does not take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM); - a cancelled entry is not released, as _hci_cmd_sync_cancel_entry() does not free entry->data when there is no destroy callback. hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Free the buffer from a destroy callback, and in the caller when the entry could not be queued at all.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from c249ea9b4309cf3250c5bbb42a05d38d0ed9071c before c2019224a766245b7db39d87fdfe84c3fdc879d9; from c249ea9b4309cf3250c5bbb42a05d38d0ed9071c before 193182c6467f508a8a61d5db506d796ffed6eee6; from c249ea9b4309cf3250c5bbb42a05d38d0ed9071c before 2e3d827cd56865c14f6ca118bbccd7801091fb21; from c249ea9b4309cf3250c5bbb42a05d38d0ed9071c before 9c3b6c1413bd0b4993642d987616331f84d9b7f5; from c249ea9b4309cf3250c5bbb42a05d38d0ed9071c before bb5ca1cc7744c41c59002bd6523714a685ae6595; from c249ea9b4309cf3250c5bbb42a05d38d0ed9071c before 120d8dc042e3d45073bb6e50ee7b058a0b182627 | CNA record |
References
- https://git.kernel.org/stable/c/c2019224a766245b7db39d87fdfe84c3fdc879d9
- https://git.kernel.org/stable/c/193182c6467f508a8a61d5db506d796ffed6eee6
- https://git.kernel.org/stable/c/2e3d827cd56865c14f6ca118bbccd7801091fb21
- https://git.kernel.org/stable/c/9c3b6c1413bd0b4993642d987616331f84d9b7f5
- https://git.kernel.org/stable/c/bb5ca1cc7744c41c59002bd6523714a685ae6595
- https://git.kernel.org/stable/c/120d8dc042e3d45073bb6e50ee7b058a0b182627
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.