CVE-2026-90253

In the Linux kernel Bluetooth MGMT subsystem , mesh_send_cancel() queues a pending command with a NULL destroy callback , meaning it is only freed if send_cancel() actually runs. When the entry is cancelled (e.g., by hci_cmd_sync_clear() on controller unregistration), _hci_cmd_sync_cancel_entry()...