CVE-2026-90253

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the Bluetooth MGMT component when a mesh send cancel command is cancelled. The mesh send cancel() function queues a pending command with a NULL destroy callback, which prevents the release of entry->data by hci cmd sync cancel entry(). This issue is triggered when hci cmd sync clear() cancels pending entries during controller unregistration. Additionally, the leak pins the socket reference created by mgmt pending new(), preventing the mgmt socket from being released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.