CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime
Bluetooth: hciconn: fix the SCO setup context lifetime
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel Bluetooth stack are affected when SCO setup work is queued. The issue involves pending Bluetooth controller command entries and connection teardown or controller unregistration.
What conditions are needed to trigger the flaw?
A SCO setup context must be queued, then either be cancelled or remain queued while its associated HCI connection is freed. Controller unregistration can cancel pending entries and trigger the leak path.
What is the practical impact?
Cancelled queued entries can leak their setup context. Because the context holds a bare HCI connection pointer, queued work can also retain a pointer to a connection that has already been freed.
What should be done if updating is not immediately possible?
The provided information does not describe a configuration workaround. Reducing or avoiding affected Bluetooth SCO setup activity may reduce exposure, but no verified mitigation is specified.