UBUNTU-CVE-2026-90255: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync() queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync() actually runs. An entry that is cancelled instead is leaked, as hcicmdsynccancelentry() does not release entry->data when there is no destroy callback, and hcicmdsyncclear() cancels every pending entry when the controller is unregistered. The context also stores a bare hciconn pointer, so the connection can be freed while the work is queued. The dequeue in hciconndel() does not cover it either, as it matches on entry->data == conn and entry->data is the wrapper here. Same problem as commit 2f5d635ad590 ("Bluetooth: hcisync: hold conn in hciconnectacl/lesync() callbacks"). Hold the connection and release both from a destroy callback. The submission failure path drops both, since hcicmdsyncsubmit() does not call the destroy callback when it fails to queue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In hci_setup_sync(), hold the hci_conn reference and release both the connection reference and the queued context from a destroy callback.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed packages are linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop.
What access does an attacker need to exploit this issue?
The CVSS vector indicates adjacent-network attack access (AV:A), with low attack complexity, no privileges required, and no user interaction required.
What is the potential security impact?
The reported CVSS score is 8.8 (High), with high potential impact to confidentiality, integrity, and availability.