CVE-2026-90255

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix the SCO setup context lifetime

hci_setup_sync() queues a conn_handle_t with a NULL destroy callback, so

the context is only freed if hci_enhanced_setup_sync() actually runs. An

entry that is cancelled instead is leaked, as

_hci_cmd_sync_cancel_entry() does not release entry->data when there is

no destroy callback, and hci_cmd_sync_clear() cancels every pending entry

when the controller is unregistered.

The context also stores a bare hci_conn pointer, so the connection can be

freed while the work is queued. The dequeue in hci_conn_del() does not

cover it either, as it matches on entry->data == conn and entry->data is

the wrapper here. Same problem as commit 2f5d635ad590 ("Bluetooth:

hci_sync: hold conn in hci_connect_acl/le_sync() callbacks").

Hold the connection and release both from a destroy callback. The

submission failure path drops both, since hci_cmd_sync_submit() does not

call the de

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References