CVE-2026-90254

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths

adv_timeout_expire() hands a kmalloc()ed instance byte to

hci_cmd_sync_queue() with a NULL destroy callback, and only

adv_timeout_expire_sync() frees it. That leaks on two paths:

- the return value is not checked, and hci_cmd_sync_queue() does not

take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM);

- a cancelled entry is not released, as _hci_cmd_sync_cancel_entry()

does not free entry->data when there is no destroy callback.

hci_cmd_sync_clear() cancels every pending entry when the controller

is unregistered.

Free the buffer from a destroy callback, and in the caller when the entry

could not be queued at all.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References