CVE-2026-90252

CVE CVE-2026-90252EUVD EUVD-2026-81845Published 2026-09-17T16:07:52.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmt_hci_cmd_sync() queues the pending command with a NULL destroy callback, so it is only freed if send_hci_cmd_sync() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev->mgmt_pending. The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released. Free the command from a destroy callback. The now-empty done label is replaced by a direct return.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 827af4787e74e8df9e8e0677a69fbb15e0856d2f <414b365ecea6c30357adee6b8a7c5edc03a03575; 6.13; 827af4787e74e8df9e8e0677a69fbb15e0856d2f <e0cd7b34dc6b5414cac3d4cd376f73d3e9ffbd93; patch: 7.2.6; patch: 0; patch: 7.3-rc1; 827af4787e74e8df9e8e0677a69fbb15e0856d2f <481533b03985177ddc805e0bd12fc07e7adf9040; patch: 6.18.52

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.