Linux Distros Unpatched Vulnerability : CVE-2026-90254

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NU...

AZL-102884 CVE-2026-90254 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

CVE-2026-90254 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

EUVD-2026-81847

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

CVE-2026-90254

CVE-2026-90254 is a memory leak in the Linux kernel's Bluetooth HCI sync subsystem. The function adv_timeout_expire() passes a kmalloc()ed advertising instance byte to hci_cmd_sync_queue() with a NULL destroy callback , causing the buffer to leak on two paths: (1) when hci_cmd_sync_queue() fails ...