UBUNTU-CVE-2026-90252: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the HCI command when it is cancelled mgmthcicmdsync() queues the pending command with a NULL destroy callback, so it is only freed if sendhcicmdsync() runs. A cancelled entry is leaked, as hcicmdsynccancelentry() does not release entry->data when there is no destroy callback, and hcicmdsyncclear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmtpendingnew() does not put the command on hdev->mgmtpending. The leak also pins the socket reference taken by mgmtpendingnew(), so the mgmt socket is never released. Free the command from a destroy callback. The now-empty done label is replaced by a direct return.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition triggers the resource leak?
The leak occurs when an HCI command queued by mgmt_hci_cmd_sync() is cancelled, including when pending entries are cancelled as part of Bluetooth controller unregistration. The cancelled entry does not free its command data because it has no destroy callback.
What resources remain retained after a cancelled command?
The HCI command allocation is leaked. The leak also retains the management socket reference acquired by mgmt_pending_new(), preventing that socket from being released.
Which Ubuntu kernel packages are listed as affected?
The listed software includes ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.