« Volver al listado

CVE-2026-90253

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: free the mesh send cancel command when it is cancelled

mesh_send_cancel() queues the pending command with a NULL destroy callback, so it is only freed if send_cancel() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev->mgmt_pending.

The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released.

Leer descripción completaMostrar menos

Free the command from a destroy callback.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90253",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
              "lessThan": "b609341ee56967d9a45845ff26f79336d2114b55",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
              "lessThan": "416fabca9b7237b76aa9cafcf8c497b8ac00d88c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
              "lessThan": "88e30d036d777b00aed42bd35000de23ff40910c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
              "lessThan": "05438d338a875a9daa08ca3f6a35b4480cf13de4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
              "lessThan": "fa46d428c014e7b72a18634679815670418e67dc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b338d91703fae6f6afd67f3f75caa3b8f36ddef3",
              "lessThan": "3c742feda8fcabf741a17bcf668b63c8f606f9c5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:21.607",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/05438d338a875a9daa08ca3f6a35b4480cf13de4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3c742feda8fcabf741a17bcf668b63c8f606f9c5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/416fabca9b7237b76aa9cafcf8c497b8ac00d88c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/88e30d036d777b00aed42bd35000de23ff40910c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b609341ee56967d9a45845ff26f79336d2114b55",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fa46d428c014e7b72a18634679815670418e67dc",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: free the mesh send cancel command when it is cancelled\n\nmesh_send_cancel() queues the pending command with a NULL destroy\ncallback, so it is only freed if send_cancel() runs. A cancelled entry is\nleaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when\nthere is no destroy callback, and hci_cmd_sync_clear() cancels every\npending entry when the controller is unregistered. Nothing else reclaims\nit either: mgmt_pending_new() does not put the command on\nhdev->mgmt_pending.\n\nThe leak also pins the socket reference taken by mgmt_pending_new(), so\nthe mgmt socket is never released.\n\nFree the command from a destroy callback."
    }
  ],
  "lastModified": "2026-09-17T17:17:21.607",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}