{"id":"CVE-2026-90252","revision":"98ba817a73e84d8b8b33ce2961f7cd55","records":[{"revision":"98ba817a73e84d8b8b33ce2961f7cd55","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90252","aliases":[],"title":"Bluetooth: MGMT: free the HCI command when it is cancelled","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: free the HCI command when it is cancelled\n\nmgmt_hci_cmd_sync() queues the pending command with a NULL destroy\ncallback, so it is only freed if send_hci_cmd_sync() runs. A cancelled\nentry is leaked, as _hci_cmd_sync_cancel_entry() does not release\nentry->data when there is no destroy callback, and hci_cmd_sync_clear()\ncancels every pending entry when the controller is unregistered. Nothing\nelse reclaims it either: mgmt_pending_new() does not put the command on\nhdev->mgmt_pending.\n\nThe leak also pins the socket reference taken by mgmt_pending_new(), so\nthe mgmt socket is never released.\n\nFree the command from a destroy callback. The now-empty done label is\nreplaced by a direct return.","state":0,"publishedAt":"2026-09-17T16:07:52.738+00:00","modifiedAt":"2026-10-19T09:00:29.101+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/mgmt.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"827af4787e74e8df9e8e0677a69fbb15e0856d2f\",\n                            \"lessThan\": \"e0cd7b34dc6b5414cac3d4cd376f73d3e9ffbd93\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"827af4787e74e8df9e8e0677a69fbb15e0856d2f\",\n                            \"lessThan\": \"481533b03985177ddc805e0bd12fc07e7adf9040\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"827af4787e74e8df9e8e0677a69fbb15e0856d2f\",\n                            \"lessThan\": \"414b365ecea6c30357adee6b8a7c5edc03a03575\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/mgmt.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/e0cd7b34dc6b5414cac3d4cd376f73d3e9ffbd93","https://git.kernel.org/stable/c/481533b03985177ddc805e0bd12fc07e7adf9040","https://git.kernel.org/stable/c/414b365ecea6c30357adee6b8a7c5edc03a03575"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90252","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90252","identifiers":["CVE-2026-90252"]},"retained":false,"historicalAffected":[]}],"coverage":[]}