Linux Kernel CVE-2026-90255

Requires the Linux Bluetooth stack to be active and a SCO/eSCO (synchronous/audio) connection setup to be initiated through hci_setup_sync(). Exploitation depends on the setup entry being cancelled rather than executed - most reliably when the HCI controller is unregistered (triggering hci_cmd_sync_clear() to cancel all pending entries), producing the leak; the use-after-free additionally requires the hci_conn to be freed while its setup work is still queued, i.e. a teardown/race window. Limiting factors: exploitation is timing/teardown-dependent (AC:H), needs Bluetooth adjacency or local access to drive controller lifecycle, and the primary impact is a kernel crash or gradual memory exhaustion rather than code execution or data theft.

The vendor CVSS 3.1 score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) substantially overstates the real-world risk of this issue. The description establishes two defects on the Bluetooth SCO/eSCO setup path: (1) a memory leak - hci_setup_sync() queues a conn_handle_t wrapper with a NULL destroy callback, so a cancelled entry (e.g. when the controller is unregistered and hci_cmd_sync_clear() cancels all pending entries) is never freed; and (2) a use-after-free - the wrapper stores a bare hci_conn pointer, so the connection can be freed while the work is still queued, and hci_conn_del()'s dequeue misses it because it matches entry->data==conn while entry->data is the wrapper. Both are memory-safety/resource-management faults whose realistic outcome is a kernel crash (UAF oops) or gradual resource exhaustion - a denial-of-service impact profile (C:N/I:N/A:H), NOT the confidentiality/integrity loss implied by C:H/I:H. The triggering conditions are teardown/error-path and race-dependent (a queued-but-cancelled SCO setup, or a free racing a queued work item), which argues for AC:H rather than AC:L. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data, so there is no signal of active or likely exploitation. Note the conflict: the CVSS advertises AV:A (Bluetooth adjacency) and PR:N, but the most reliable leak trigger is the local controller-unregister path - verify the true remote-triggerability with the vendor. Net: a low-to-moderate DoS in a niche kernel path, not a network-exploitable RCE-grade priority.

An attacker within Bluetooth range (or a local user manipulating the controller) initiates and then aborts a SCO/eSCO audio connection setup so that the queued setup context is cancelled before hci_enhanced_setup_sync() runs, or races connection teardown against the queued work. This leaks kernel memory on each cancellation or dereferences a freed hci_conn, eventually crashing the kernel (use-after-free oops) or exhausting memory. No public exploit code is identified at time of analysis, and the race/teardown nature makes reliable triggering difficult.