CVE-2026-90252: Bluetooth: MGMT: free the HCI command when it is cancelled
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: free the HCI command when it is cancelled
mgmthcicmdsync() queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync() runs. A cancelled entry is leaked, as hcicmdsynccancelentry() does not release entry->data when there is no destroy callback, and hcicmdsyncclear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmtpendingnew() does not put the command on hdev->mgmtpending.
The leak also pins the socket reference taken by mgmtpendingnew(), so the mgmt socket is never released.
Free the command from a destroy callback. The now-empty done label is replaced by a direct return.
Event History
Frequently Asked Questions
Under what condition can the resource leak be triggered?
The leak occurs when a pending HCI command created through mgmt_hci_cmd_sync() is cancelled before send_hci_cmd_sync() runs. Controller unregistration triggers hci_cmd_sync_clear(), which cancels pending entries.
What resources remain allocated after cancellation?
The cancelled command data is not freed because the pending command has no destroy callback. The leak also retains the socket reference acquired by mgmt_pending_new(), preventing the associated MGMT socket from being released.