Cloudanix VulnDB

CVE-2026-90252

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux Bluetooth code can slowly use up memory without releasing it, which may eventually slow down or crash devices that use Bluetooth features.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Memory leak in Linux kernel Bluetooth MGMT code where cancelled HCI command entries lack a destroy callback, preventing release of entry->data and pinning socket references from mgmt_pending_new when controllers unregister via hci_cmd_sync_clear.

Why it matters to the business

Prolonged Bluetooth activity on Linux systems can exhaust kernel memory and hold socket resources, leading to gradual performance degradation or crashes on servers, embedded devices, or IoT hardware that rely on Bluetooth management interfaces.

How an attack unfolds

An attacker with local or Bluetooth-adjacent access triggers repeated cancellation paths for pending MGMT HCI commands, such as by forcing controller unregistration or specific sync operation failures, causing unreclaimed allocations and socket references that accumulate without direct code execution.

How to fix it

Apply the upstream kernel patch that adds a destroy callback to free the HCI command and release the socket reference; rebuild and deploy updated kernels on all affected Linux distributions, prioritizing systems with active Bluetooth stacks.

How to confirm the fix worked

Confirm the patch is present by inspecting mgmt.c for the destroy callback assignment in mgmt_hci_cmd_sync and verify no leaks occur under repeated cancel/clear sequences using kernel memory accounting tools.

Typical attack path

  1. Establish or manipulate Bluetooth controller state to queue MGMT commands via mgmt_hci_cmd_sync with NULL destroy callback
  2. Force cancellation of entries through hci_cmd_sync_cancel_entry or controller removal via hci_cmd_sync_clear
  3. Repeat operations to accumulate unreleased memory and pinned sockets without triggering normal reclamation paths

How to detect it

Review kernel logs for repeated Bluetooth MGMT cancellation events around controller registration changes; use memory leak detectors or slab accounting to observe growth in unreclaimed HCI command structures during Bluetooth activity.

What your security team should do

  • Prioritize kernel updates on any Linux hosts exposing Bluetooth MGMT interfaces within 30 days
  • Disable unnecessary Bluetooth services on servers and embedded systems where feasible
  • Monitor kernel memory usage trends on Bluetooth-enabled devices for unexplained growth

The record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmt_hci_cmd_sync() queues the pending command with a NULL destroy callback, so it is only freed if send_hci_cmd_sync() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev->mgmt_pending. The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released. Free the command from a destroy callback. The now-empty done label is replaced by a direct return.

Affected packages

Ecosystem Package Introduced Fixed