https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 12:11:24 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90254 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths</p> <p>adv_timeout_expire() hands a kmalloc()ed instance byte to hci_cmd_sync_queue() with a NULL destroy callback, and only adv_timeout_expire_sync() frees it. That leaks on two paths:</p> <p>- the return value is not checked, and hci_cmd_sync_queue() does not take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM);</p> <p>- a cancelled entry is not released, as _hci_cmd_sync_cancel_entry() does not free entry-&gt;data when there is no destroy callback. hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered.</p> <p>Free the buffer from a destroy callback, and in the caller when the entry could not be queued at all.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths</p> <p>adv_timeout_expire() hands a kmalloc()ed instance byte to hci_cmd_sync_queue() with a NULL destroy callback, and only adv_timeout_expire_sync() frees it. That leaks on two paths:</p> <p>- the return value is not checked, and hci_cmd_sync_queue() does not take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM);</p> <p>- a cancelled entry is not released, as _hci_cmd_sync_cancel_entry() does not free entry-&gt;data when there is no destroy callback. hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered.</p> <p>Free the buffer from a destroy callback, and in the caller when the entry could not be queued at all.</p> https://vulnerability.circl.lu/vuln/cve-2026-90254