« Volver al listado

CVE-2026-90254

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths

adv_timeout_expire() hands a kmalloc()ed instance byte to hci_cmd_sync_queue() with a NULL destroy callback, and only adv_timeout_expire_sync() frees it. That leaks on two paths:

Free the buffer from a destroy callback, and in the caller when the entry could not be queued at all.

Detalles técnicos trazas, registros y código del informe original
 - the return value is not checked, and hci_cmd_sync_queue() does not
   take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM);

 - a cancelled entry is not released, as _hci_cmd_sync_cancel_entry()
   does not free entry->data when there is no destroy callback.
   hci_cmd_sync_clear() cancels every pending entry when the controller
   is unregistered.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90254",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "c249ea9b4309cf3250c5bbb42a05d38d0ed9071c",
              "lessThan": "c2019224a766245b7db39d87fdfe84c3fdc879d9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c249ea9b4309cf3250c5bbb42a05d38d0ed9071c",
              "lessThan": "193182c6467f508a8a61d5db506d796ffed6eee6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c249ea9b4309cf3250c5bbb42a05d38d0ed9071c",
              "lessThan": "2e3d827cd56865c14f6ca118bbccd7801091fb21",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c249ea9b4309cf3250c5bbb42a05d38d0ed9071c",
              "lessThan": "9c3b6c1413bd0b4993642d987616331f84d9b7f5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c249ea9b4309cf3250c5bbb42a05d38d0ed9071c",
              "lessThan": "bb5ca1cc7744c41c59002bd6523714a685ae6595",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c249ea9b4309cf3250c5bbb42a05d38d0ed9071c",
              "lessThan": "120d8dc042e3d45073bb6e50ee7b058a0b182627",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/bluetooth/hci_sync.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:21.730",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/120d8dc042e3d45073bb6e50ee7b058a0b182627",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/193182c6467f508a8a61d5db506d796ffed6eee6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2e3d827cd56865c14f6ca118bbccd7801091fb21",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9c3b6c1413bd0b4993642d987616331f84d9b7f5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bb5ca1cc7744c41c59002bd6523714a685ae6595",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c2019224a766245b7db39d87fdfe84c3fdc879d9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_sync: free the advertising instance on the failure and cancel paths\n\nadv_timeout_expire() hands a kmalloc()ed instance byte to\nhci_cmd_sync_queue() with a NULL destroy callback, and only\nadv_timeout_expire_sync() frees it. That leaks on two paths:\n\n - the return value is not checked, and hci_cmd_sync_queue() does not\n   take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM);\n\n - a cancelled entry is not released, as _hci_cmd_sync_cancel_entry()\n   does not free entry->data when there is no destroy callback.\n   hci_cmd_sync_clear() cancels every pending entry when the controller\n   is unregistered.\n\nFree the buffer from a destroy callback, and in the caller when the entry\ncould not be queued at all."
    }
  ],
  "lastModified": "2026-09-17T17:17:21.730",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}