CVE-2026-90254

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak occurs in the Bluetooth subsystem when adv timeout expire() passes a memory instance allocated via kmalloc() to hci cmd sync queue() without a destroy callback. This leads to memory leaks in two scenarios: when hci cmd sync queue() fails (returning -ENETDOWN, -ENODEV, or -ENOMEM) because the return value is not checked, and when an entry is cancelled via hci cmd sync cancel entry() because entry->data is not freed in the absence of a destroy callback. This latter case occurs during controller unregistration when hci cmd sync clear() cancels pending entries.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.