« Volver al listado

CVE-2026-90255

Estado: RecibidaAlta (8.8)—

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix the SCO setup context lifetime

hci_setup_sync() queues a conn_handle_t with a NULL destroy callback, so the context is only freed if hci_enhanced_setup_sync() actually runs. An entry that is cancelled instead is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered.

The context also stores a bare hci_conn pointer, so the connection can be freed while the work is queued.

Leer descripción completaMostrar menos

The dequeue in hci_conn_del() does not cover it either, as it matches on entry->data == conn and entry->data is the wrapper here. Same problem as commit 2f5d635ad590 ("Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks").

Hold the connection and release both from a destroy callback. The submission failure path drops both, since hci_cmd_sync_submit() does not call the destroy callback when it fails to queue.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad en kernel Linux con acceso local (AV:A) en subsistema Bluetooth. La fuga de memoria y corrupción de punteros podría permitir DoS o corrupción de datos de conexión, pero impacto real limitado por contexto de red adyacente y falta de detalles de explotación.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningThreat Intelligence ProgramPrivileged Account ManagementNetwork SegmentationFilter Network TrafficDisable or Remove Feature or Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-90255",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e07a06b4eb417f5271d33ce2240e93c62d98b7b4",
              "lessThan": "37cfec41365c826d5496ef5d00c9e215eee53aa2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e07a06b4eb417f5271d33ce2240e93c62d98b7b4",
              "lessThan": "9a2ba69cebe3fc5a3d4fa8eaaad3c42862723c27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e07a06b4eb417f5271d33ce2240e93c62d98b7b4",
              "lessThan": "a661de0ee29d0915c5e924edf91d2be2b4d35bae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e07a06b4eb417f5271d33ce2240e93c62d98b7b4",
              "lessThan": "c1fe3c74a89a7749cba3caa0dd91236049c66116",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e07a06b4eb417f5271d33ce2240e93c62d98b7b4",
              "lessThan": "4d7b1c834d2775b73c65e4888e01f5af8b477fe9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e07a06b4eb417f5271d33ce2240e93c62d98b7b4",
              "lessThan": "42de40abe25db9211107af8896d0fd741f10648d",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.1",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/bluetooth/hci_conn.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:21.853",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/37cfec41365c826d5496ef5d00c9e215eee53aa2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/42de40abe25db9211107af8896d0fd741f10648d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4d7b1c834d2775b73c65e4888e01f5af8b477fe9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9a2ba69cebe3fc5a3d4fa8eaaad3c42862723c27",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a661de0ee29d0915c5e924edf91d2be2b4d35bae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c1fe3c74a89a7749cba3caa0dd91236049c66116",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: fix the SCO setup context lifetime\n\nhci_setup_sync() queues a conn_handle_t with a NULL destroy callback, so\nthe context is only freed if hci_enhanced_setup_sync() actually runs. An\nentry that is cancelled instead is leaked, as\n_hci_cmd_sync_cancel_entry() does not release entry->data when there is\nno destroy callback, and hci_cmd_sync_clear() cancels every pending entry\nwhen the controller is unregistered.\n\nThe context also stores a bare hci_conn pointer, so the connection can be\nfreed while the work is queued. The dequeue in hci_conn_del() does not\ncover it either, as it matches on entry->data == conn and entry->data is\nthe wrapper here. Same problem as commit 2f5d635ad590 (\"Bluetooth:\nhci_sync: hold conn in hci_connect_acl/le_sync() callbacks\").\n\nHold the connection and release both from a destroy callback. The\nsubmission failure path drops both, since hci_cmd_sync_submit() does not\ncall the destroy callback when it fails to queue."
    }
  ],
  "lastModified": "2026-09-18T18:17:51.010",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}