Executive brief
The Linux kernel's Bluetooth SCO (Synchronous Connection Oriented) setup code contains a memory management vulnerability that can leak kernel memory and allow use-after-free conditions. When SCO connections are queued but then cancelled, allocated context structures are not properly freed, and connection objects can be released while still referenced by queued operations, potentially leading to crashes or information disclosure.
Technical details
The vulnerability exists in the hci_setup_sync() function in net/bluetooth/hci_conn.c, which queues an asynchronous command with a NULL destroy callback. This causes two issues: (1) if the queued operation is cancelled instead of executed, the conn_handle_t context is leaked because _hci_cmd_sync_cancel_entry() does not release entry->data without a destroy callback, and (2) the function stores a bare hci_conn pointer that can be freed while the work is still queued, leading to use-after-free. The fix adds a proper destroy callback (hci_enhanced_setup_sync_destroy) that uses reference counting (hci_conn_get/hci_conn_put) to safely manage connection lifetime and always frees the context structure. Local/root privilege level is required to trigger this via Bluetooth connection setup operations.
Affected products
- Linux Linux Kernel Versions before fix commit 42de40abe25db9211107af8896d0fd741f10648d
Timeline
- 2026-09-17: disclosed: CVE-2026-90255 published
- 2026-08-06: patched: Fix committed upstream (commit 42de40abe25db9211107af8896d0fd741f10648d)
- 2026-09-14: patched: Patch released in stable kernels (commit 37cfec41365c826d5496ef5d00c9e215eee53aa2)