https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:26:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90252 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: MGMT: free the HCI command when it is cancelled</p> <p>mgmt_hci_cmd_sync() queues the pending command with a NULL destroy callback, so it is only freed if send_hci_cmd_sync() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry-&gt;data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev-&gt;mgmt_pending.</p> <p>The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released.</p> <p>Free the command from a destroy callback. The now-empty done label is replaced by a direct return.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: MGMT: free the HCI command when it is cancelled</p> <p>mgmt_hci_cmd_sync() queues the pending command with a NULL destroy callback, so it is only freed if send_hci_cmd_sync() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry-&gt;data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev-&gt;mgmt_pending.</p> <p>The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released.</p> <p>Free the command from a destroy callback. The now-empty done label is replaced by a direct return.</p> https://vulnerability.circl.lu/vuln/cve-2026-90252