CVE-2026-90255: Bluetooth: hci_conn: fix the SCO setup context lifetime
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: hciconn: fix the SCO setup context lifetime
hcisetupsync() queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync() actually runs. An entry that is cancelled instead is leaked, as hcicmdsynccancelentry() does not release entry->data when there is no destroy callback, and hcicmdsyncclear() cancels every pending entry when the controller is unregistered.
The context also stores a bare hciconn pointer, so the connection can be freed while the work is queued. The dequeue in hciconndel() does not cover it either, as it matches on entry->data == conn and entry->data is the wrapper here. Same problem as commit 2f5d635ad590 ("Bluetooth: hcisync: hold conn in hciconnectacl/lesync() callbacks").
Hold the connection and release both from a destroy callback. The submission failure path drops both, since hcicmdsyncsubmit() does not call the destroy callback when it fails to queue.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the Linux kernel Bluetooth stack are affected when SCO setup work is queued. The issue involves pending Bluetooth controller command entries and connection teardown or controller unregistration.
What conditions are needed to trigger the flaw?
A SCO setup context must be queued, then either be cancelled or remain queued while its associated HCI connection is freed. Controller unregistration can cancel pending entries and trigger the leak path.
What is the practical impact?
Cancelled queued entries can leak their setup context. Because the context holds a bare HCI connection pointer, queued work can also retain a pointer to a connection that has already been freed.
What should be done if updating is not immediately possible?
The provided information does not describe a configuration workaround. Reducing or avoiding affected Bluetooth SCO setup activity may reduce exposure, but no verified mitigation is specified.