{"id":"CVE-2026-90255","published":"2026-09-17T17:17:21.853","lastModified":"2026-09-18T18:17:51.010","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: hci_conn: fix the SCO setup context lifetime\n\nhci_setup_sync() queues a conn_handle_t with a NULL destroy callback, so\nthe context is only freed if hci_enhanced_setup_sync() actually runs. An\nentry that is cancelled instead is leaked, as\n_hci_cmd_sync_cancel_entry() does not release entry->data when there is\nno destroy callback, and hci_cmd_sync_clear() cancels every pending entry\nwhen the controller is unregistered.\n\nThe context also stores a bare hci_conn pointer, so the connection can be\nfreed while the work is queued. The dequeue in hci_conn_del() does not\ncover it either, as it matches on entry->data == conn and entry->data is\nthe wrapper here. Same problem as commit 2f5d635ad590 (\"Bluetooth:\nhci_sync: hold conn in hci_connect_acl/le_sync() callbacks\").\n\nHold the connection and release both from a destroy callback. The\nsubmission failure path drops both, since hci_cmd_sync_submit() does not\ncall the destroy callback when it fails to queue.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/37cfec41365c826d5496ef5d00c9e215eee53aa2","tags":[]},{"url":"https://git.kernel.org/stable/c/42de40abe25db9211107af8896d0fd741f10648d","tags":[]},{"url":"https://git.kernel.org/stable/c/4d7b1c834d2775b73c65e4888e01f5af8b477fe9","tags":[]},{"url":"https://git.kernel.org/stable/c/9a2ba69cebe3fc5a3d4fa8eaaad3c42862723c27","tags":[]},{"url":"https://git.kernel.org/stable/c/a661de0ee29d0915c5e924edf91d2be2b4d35bae","tags":[]},{"url":"https://git.kernel.org/stable/c/c1fe3c74a89a7749cba3caa0dd91236049c66116","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability in the Linux kernel's Bluetooth stack allows an attacker to leak memory contexts and potentially free connections while work is queued, leading to potential denial of service or other issues.","exploitability":"Exploitation requires the attacker to cancel a Bluetooth connection setup, which is a precondition. The difficulty is moderate as it depends on specific timing and control over the connection setup process.","blast_radius":"If exploited, the impact is likely limited to the affected Bluetooth connection and could result in denial of service for that connection.","remediation":"Upgrade to the fixed version 6.2-rc1 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["bluetooth","memory-leak","dos"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-29T09:25:37.906Z"}}