CVE intelligence

CVE-2026-90252

Vulnerability intelligence

Published Sep 17, 2026Sources checked Oct 21, 2026

N/ACVSS not listedScore unavailable

What this means

Review the available evidence

CVE-2026-90252. It is not in the current CISA KEV record we collected. That does not prove exploitation has not occurred.

CISA KEVNot listedBased on the latest collected catalog

EPSS0.2%Estimated 30-day exploitation probability

Ransomware useNot markedCISA KEV ransomware field

Threat actors0Source-linked actor relationships

Overview

What is CVE-2026-90252?

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: free the HCI command when it is cancelled

mgmt_hci_cmd_sync() queues the pending command with a NULL destroy callback, so it is only freed if send_hci_cmd_sync() runs. A cancelled entry is leaked, as _hci_cmd_sync_cancel_entry() does not release entry->data when there is no destroy callback, and hci_cmd_sync_clear() cancels every pending entry when the controller is unregistered.

Nothing else reclaims it either: mgmt_pending_new() does not put the command on hdev->mgmt_pending.

The leak also pins the socket reference taken by mgmt_pending_new(), so the mgmt socket is never released.

Free the command from a destroy callback. The now-empty done label is replaced by a direct return.

Source: NVD