CVE-2026-90254

What it actually does

Memory leak of kmalloc-allocated advertising instance in Bluetooth HCI sync paths: adv_timeout_expire passes buffer without destroy callback, hci_cmd_sync_queue fails to take ownership on -ENETDOWN/-ENODEV/-ENOMEM, and _hci_cmd_sync_cancel_entry plus hci_cmd_sync_clear do not release entry->data on cancel or controller unregister.

Why it matters to the business

Gradual kernel memory exhaustion on Bluetooth-enabled Linux systems can lead to performance degradation, instability, or denial of service after repeated advertising timeout or controller events; low EPSS and no KEV listing indicate limited immediate exploitation urgency but patch promptly on affected kernels.

How an attack unfolds

An attacker triggers repeated Bluetooth advertising timeout expirations or controller unregistration sequences that exercise the failure and cancel paths in hci_cmd_sync_queue, causing the allocated instance to be lost without free; over many iterations this depletes memory without direct code execution.

How to fix it

Update to a kernel containing the referenced fix that supplies a destroy callback for the advertising instance and frees the buffer on queue failure; rebuild and deploy the patched kernel image across all affected systems.

How to confirm the fix worked

Inspect kernel source for presence of destroy callback in hci_cmd_sync_queue call from adv_timeout_expire and explicit kfree on queue failure; run kmemleak or slabinfo before/after advertising timeout cycles to confirm no residual allocations.

Typical attack path

1. Establish or manipulate Bluetooth advertising sessions to invoke adv_timeout_expire
2. Force error returns from hci_cmd_sync_queue or trigger hci_cmd_sync_clear via controller removal
3. Repeat to accumulate leaked allocations until memory pressure manifests

How to detect it

Monitor kernel logs for Bluetooth HCI errors coinciding with controller registration changes; use kmemleak reports or slabtop to observe growing allocations in the Bluetooth module; review dmesg for hci_cmd_sync related failures during device unplug or error conditions.

What your security team should do

• Prioritize kernel update on any system exposing Bluetooth HCI
• Enable CONFIG_DEBUG_KMEMLEAK and monitor for Bluetooth-related leaks
• Restrict unprivileged Bluetooth advertising where possible until patched