VulnerabilityPublished 17 Sep 2026Updated 30 Oct 2026

CVE-2026-90087: Linux kernel · Bluetooth: do not leak an hci_conn when a second LE connect is rejected

Source GCVE Database

Compare

Authoritative record:CVE-2026-90087· Medium

Not known to be exploited · fixed in a78d16530c1538a215a827c7c3a4b408d6759bc0 : update Linux kernel when convenient.

Data as of 30 Oct 2026, 19:18 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in a78d16530c1538a215a827c7c3a4b408d6759bc0, 78970b39529844b31df2949015f66752e17210fe, 42fe0278d05d75c405abad62dafaeec713cec2e2 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-f3f5-q254-2957

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=5.17.14 <5.18 >=5.18.3 <5.19	Fixed in a78d16530c1538a215a827c7c3a4b408d6759bc0 78970b39529844b31df2949015f66752e17210fe 42fe0278d05d75c405abad62dafaeec713cec2e2 8a8585e421d06f878b33ef79f82cace0d485e3d8 7e1e4047200fd7519f9bdfe8a001437715e618b4 5.19 5.18 2eafcf310f4e0ad4f387881db01116bbe3cc0b39
LinuxLinux	Affected =5.19	Fixed in–

AI-suggested

If you cannot patch yet, affected systems may require manual Bluetooth adapter resets to recover from this state.

Description

A vulnerability in the Linux kernel Bluetooth subsystem causes a leaked hci_conn object when a second LE connection attempt is rejected. This leak results in the connection remaining indefinitely in a pending state, blocking further connection attempts until the adapter is reset.

Impact

The vulnerability causes a resource leak of the hci_conn structure for a failed LE connection attempt, which blocks all subsequent LE connection attempts on the affected Bluetooth adapter. This results in a denial of service for Bluetooth LE connections until the adapter is reset. No remote code execution or privilege escalation is indicated.

Summary

The Linux kernel Bluetooth code mishandles multiple simultaneous LE connection attempts. Specifically, create_le_conn_complete() uses hci_lookup_le_connect() to check if a failed connection is still pending, but this lookup only returns the first pending connection. When two connections are pending, the lookup may return one connection while the failure of the other is reported, causing the error to be dropped and hci_conn_failed() not to run on the failed connection. This leads to the failed connection remaining in BT_CONNECT indefinitely. Because hci_connect_le() refuses to initiate new connections while any connection is pending, subsequent connection attempts fail with -EBUSY and no commands reach the controller. The issue was observed on a bcm43438 controller where two BLE peers polled on the same interval caused the problem. The fix involves querying the connection itself rather than the device to correctly handle multiple pending connections and clean up failed ones.

References

Community reviews

Loading reviews…