Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90254— Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已修复： Bluetooth: hci_sync: 在失败和取消路径中释放广播实例 将一个通过 分配的实例字节数组传递给 ，但未提供销毁（destroy）回调，只有 才会释放该内存。这会导致在以下两条路径中发生内存泄漏： 1. 未检查返回值，且当 失败时（如返回 、 或 ），它不会接管所有权； 2. 被取消的条目未被释放，因为 在没有销毁回调的情况下不会释放 。而 会在控制器注销时取消所有待处理条目。 修复方法是：通过销毁回调释放缓冲区，并在条目完全无法入队的情况下由调用方负责释放。

AI Predicted 4.0 Difficulty: Hard

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux c249ea9b4309cf3250c5bbb42a05d38d0ed9071c< c2019224a766245b7db39d87fdfe84c3fdc879d9 affected
c249ea9b4309cf3250c5bbb42a05d38d0ed9071c< 193182c6467f508a8a61d5db506d796ffed6eee6 affected
c249ea9b4309cf3250c5bbb42a05d38d0ed9071c< 2e3d827cd56865c14f6ca118bbccd7801091fb21 affected
c249ea9b4309cf3250c5bbb42a05d38d0ed9071c< 9c3b6c1413bd0b4993642d987616331f84d9b7f5 affected
c249ea9b4309cf3250c5bbb42a05d38d0ed9071c< bb5ca1cc7744c41c59002bd6523714a685ae6595 affected
c249ea9b4309cf3250c5bbb42a05d38d0ed9071c< 120d8dc042e3d45073bb6e50ee7b058a0b182627 affected
6.1 affected
< 6.1 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90254

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths adv_timeout_expire() hands a kmalloc()ed instance byte to hci_cmd_sync_queue() with a NULL destroy callback, and only adv_timeout_expire_sync() frees it. That leaks on two paths: - the return value is not checked, and hci_cmd_sync_queue() does not take ownership when it fails (-ENETDOWN, -ENODEV, -ENOMEM); - a cancelled entry is not released, as _hci_cmd_sync_cancel_entry() does not free entry->data when there is no destroy callback. hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Free the buffer from a destroy callback, and in the caller when the entry could not be queued at all.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c249ea9b4309cf3250c5bbb42a05d38d0ed9071c ~ c2019224a766245b7db39d87fdfe84c3fdc879d9 -
Linux Linux 6.1 -

II. Public POCs for CVE-2026-90254

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90254

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90254 (3)

Other References for CVE-2026-90254 (3)

Same Patch Batch · Linux · 2026-09-17 · 602 CVEs total

CVE-2026-90257 Bluetooth: virtio_bt: avoid OOB read of build info string
CVE-2026-90238 media: amd: isp4: fix self-deadlock in isp4sd_pwron_and_init() error path
CVE-2026-90240 iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90239 media: amd: isp4: release partial allocations in isp4if_alloc_fw_gpumem()
CVE-2026-90241 iommu/vt-d: Tear down scalable-mode context on probe failure
CVE-2026-90243 iommu/vt-d: Clear Present bit before tearing down copied context entry
CVE-2026-90242 iommu/vt-d: Fix iopf_refcount leak on RID domain replacement
CVE-2026-90244 iommu/dma: Restore locking around msi_page_list
CVE-2026-90245 fbdev: kyro: Validate overlay viewport coordinates
CVE-2026-90246 apparmor: fix integer overflow in verify_tags() bounds check
CVE-2026-90247 bpf: Fix mmap_lock leak in irq_work path
CVE-2026-90248 net/sched: cls_api: fix teardown of an adopted proto on insert-race loss
CVE-2026-90249 iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
CVE-2026-90250 bpf, cgroup: Fix storage null-ptr-deref after replacing prog
CVE-2026-90251 Bluetooth: MSFT: validate evt_prefix_len against the response length
CVE-2026-90253 Bluetooth: MGMT: free the mesh send cancel command when it is cancelled
CVE-2026-90252 Bluetooth: MGMT: free the HCI command when it is cancelled
CVE-2026-90256 Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind
CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime
CVE-2026-90267 scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails

Showing top 20 of 602 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90254

No comments yet

Leave a comment