Към съдържанието
Търсене

CVE-2026-90087: Linux

Няма оценка

CVSS

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hci_conn when a second LE connect is rejected create_le_conn_complete() decides whether the failed connection is still pending by comparing it against hci_lookup_le_connect(), which returns the first LE connection in BT_CONNECT. That is the same connection only while at most one is pending. Two can be pending. Connections created on the passive scan path sit in BT_CONNECT with HCI_CONN_SCANNING set and are invisible to hci_lookup_le_connect() until hci_le_create_conn_sync() clears the flag when their command is issued, so the -EBUSY guard in hci_connect_le() does not prevent a second connection from being queued while the first is still on the scan path. Whenever two connections are in BT_CONNECT at once, the lookup may return one connection while create_le_conn_complete() is reporting the failure of the other; the early exit then drops the error and hci_conn_failed() never runs on the connection that failed. The controller also rejects a second HCI_OP_LE_CREATE_CONN issued while another connection creation is still outstanding, per Core Spec Vol 4, Part E. The spec calls for Command Disallowed there; the bcm43438 observed here answers with an LMP/LL error code instead, which bt_to_errno() maps to the -EPROTO (-71) in the log below. The leaked connection stays in BT_CONNECT forever, and because hci_connect_le() refuses to dial while hci_lookup_le_connect() finds anything, every subsequent attempt to reach any peer fails with -EBUSY and no command reaches the controller at all. Seen on a bcm43438 with two BLE peers polled on the same interval (state 5 is BT_CONNECT; both handles are UNSET ones, allocated from the ida above HCI_CONN_HANDLE_MAX): Bluetooth: hci1: Opcode 0x2013 failed: -71 # hcitool con < LE 14:9C:EF:03:68:81 handle 3840 state 5 lm CENTRAL < LE C4:D3:6A:8C:B5:38 handle 3841 state 5 lm CENTRAL A btmon capture across the next ten

    Засегнати продукти

    • Linux Linux: c9f73a2178c12fb24d2807634209559d6a836e08 преди 42fe0278d05d75c405abad62dafaeec713cec2e2; c9f73a2178c12fb24d2807634209559d6a836e08 преди a78d16530c1538a215a827c7c3a4b408d6759bc0; c9f73a2178c12fb24d2807634209559d6a836e08 преди 78970b39529844b31df2949015f66752e17210fe; c9f73a2178c12fb24d2807634209559d6a836e08 преди 8a8585e421d06f878b33ef79f82cace0d485e3d8; c9f73a2178c12fb24d2807634209559d6a836e08 преди 2eafcf310f4e0ad4f387881db01116bbe3cc0b39; c9f73a2178c12fb24d2807634209559d6a836e08 преди 7e1e4047200fd7519f9bdfe8a001437715e618b4; ee23bb0e4315476413e4e1ed9c486d6f9472294d; da499d598cb84b45a2aa930dc9213dc9a746a81d; 5.17.14 преди 5.18; 5.18.3 преди 5.19
    • Linux Linux: 5.19; преди 5.19; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.114 до 6.12.*; 6.18.57 до 6.18.*; 7.2.6 до 7.2.*; 7.3 до *

    История

    • 17 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-90087: Linux | freedomonline.bg