Answer in brief
CVE-2026-90253 records a Unknown severity vulnerability in Bluetooth: MGMT: free the mesh send cancel command when it is cancelled. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <b609341ee56967d9a45845ff26f79336d2114b55 || >=b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <416fabca9b7237b76aa9cafcf8c497b8ac00d88c || >=b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <88e30d036d777b00aed42bd35000de23ff40910c || >=b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <05438d338a875a9daa08ca3f6a35b4480cf13de4 || >=b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <fa46d428c014e7b72a18634679815670418e67dc || >=b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <3c742feda8fcabf741a17bcf668b63c8f606f9c5 | b609341ee56967d9a45845ff26f79336d2114b55, 416fabca9b7237b76aa9cafcf8c497b8ac00d88c, 88e30d036d777b00aed42bd35000de23ff40910c, 05438d338a875a9daa08ca3f6a35b4480cf13de4, fa46d428c014e7b72a18634679815670418e67dc, 3c742feda8fcabf741a17bcf668b63c8f606f9c5 |
| Linux/Linuxgeneric | 6.1 | Not reported |
Published upstream
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 17, 2026
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: free the mesh send cancel command when it is cancelled mesh_send_cancel() queues the pending command with a NULL destroy callback, so it is only freed if send_cancel() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered. Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev->mgmt_pending. The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released. Free the command from a destroy callback.
Quoted source text, attributed separately from HOL analysis.