CVE-2026-23151

{"id": "CVE-2026-23151", "cveTags": [], "metrics": {}, "published": "2026-02-14T16:15:55.233", "references": [{"url": "https://git.kernel.org/stable/c/1850a558d116d7e3e2ef36d06a56f59b640cc214", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/1b9c17fd0a7fdcbe69ec5d6fe8e50bc5ed7f01f2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3b6318505378828ee415d6ef678db6a74c077504", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix memory leak in set_ssp_complete\n\nFix memory leak in set_ssp_complete() where mgmt_pending_cmd structures\nare not freed after being removed from the pending list.\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") replaced\nmgmt_pending_foreach() calls with individual command handling but missed\nadding mgmt_pending_free() calls in both error and success paths of\nset_ssp_complete(). Other completion functions like set_le_complete()\nwere fixed correctly in the same commit.\n\nThis causes a memory leak of the mgmt_pending_cmd structure and its\nassociated parameter data for each SSP command that completes.\n\nAdd the missing mgmt_pending_free(cmd) calls in both code paths to fix\nthe memory leak. Also fix the same issue in set_advertising_complete()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: MGMT: Correcci\u00f3n de fuga de memoria en set_ssp_complete\n\nCorrige la fuga de memoria en set_ssp_complete() donde las estructuras mgmt_pending_cmd no son liberadas despu\u00e9s de ser eliminadas de la lista de pendientes.\n\nEl commit 302a1f674c00 ('Bluetooth: MGMT: Corrige posibles UAFs') reemplaz\u00f3 las llamadas a mgmt_pending_foreach() con el manejo individual de comandos, pero omiti\u00f3 a\u00f1adir llamadas a mgmt_pending_free() tanto en las rutas de error como de \u00e9xito de set_ssp_complete(). Otras funciones de completado como set_le_complete() fueron corregidas correctamente en el mismo commit.\n\nEsto causa una fuga de memoria de la estructura mgmt_pending_cmd y sus datos de par\u00e1metros asociados para cada comando SSP que se completa.\n\nA\u00f1ade las llamadas faltantes a mgmt_pending_free(cmd) en ambas rutas de c\u00f3digo para corregir la fuga de memoria. Tambi\u00e9n corrige el mismo problema en set_advertising_complete()."}], "lastModified": "2026-02-18T17:52:44.520", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}