Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: free the HCI command when it is cancelled
mgmt_hci_cmd_sync() queues the pending command with a NULL destroy callback, so it is only freed if send_hci_cmd_sync() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev->mgmt_pending.
The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released.
Free the command from a destroy callback. The now-empty done label is replaced by a direct return.
Metrics
No CVSS score has been published yet.
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 827af4787e74e8df9e8e0677a69fbb15e0856d2f, < e0cd7b34dc6b5414cac3d4cd376f73d3e9ffbd93; >= 827af4787e74e8df9e8e0677a69fbb15e0856d2f, < 481533b03985177ddc805e0bd12fc07e7adf9040; >= 827af4787e74e8df9e8e0677a69fbb15e0856d2f, < 414b365ecea6c30357adee6b8a7c5edc03a03575 |
| Linux | Linux | 6.13 |
References
Timeline
- Published
- Sep 17, 2026
- Last modified
- Oct 19, 2026
- NVD status
- Received