{"id":"CVE-2026-90252","published":"2026-09-17T17:17:21.500","lastModified":"2026-09-17T17:17:21.500","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: free the HCI command when it is cancelled\n\nmgmt_hci_cmd_sync() queues the pending command with a NULL destroy\ncallback, so it is only freed if send_hci_cmd_sync() runs. A cancelled\nentry is leaked, as _hci_cmd_sync_cancel_entry() does not release\nentry->data when there is no destroy callback, and hci_cmd_sync_clear()\ncancels every pending entry when the controller is unregistered. Nothing\nelse reclaims it either: mgmt_pending_new() does not put the command on\nhdev->mgmt_pending.\n\nThe leak also pins the socket reference taken by mgmt_pending_new(), so\nthe mgmt socket is never released.\n\nFree the command from a destroy callback. The now-empty done label is\nreplaced by a direct return.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/414b365ecea6c30357adee6b8a7c5edc03a03575","tags":[]},{"url":"https://git.kernel.org/stable/c/481533b03985177ddc805e0bd12fc07e7adf9040","tags":[]},{"url":"https://git.kernel.org/stable/c/e0cd7b34dc6b5414cac3d4cd376f73d3e9ffbd93","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}