CVE-2026-90252

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the Bluetooth MGMT component when an HCI command is cancelled. The mgmt hci cmd sync() function queues pending commands with a NULL destroy callback, meaning they are only freed if send hci cmd sync() executes. When hci cmd sync clear() cancels pending entries during controller unregistration, hci cmd sync cancel entry() fails to release entry->data due to the missing callback. Additionally, mgmt pending new() does not place the command on hdev->mgmt pending, leaving no other mechanism for reclamation. This leak also prevents the release of the mgmt socket by pinning the socket reference taken by mgmt pending new().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.