CVE-2026-23151

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix memory leak in setsspcomplete

Fix memory leak in setsspcomplete() where mgmtpendingcmd structures are not freed after being removed from the pending list.

Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmtpendingforeach() calls with individual command handling but missed adding mgmtpendingfree() calls in both error and success paths of setsspcomplete(). Other completion functions like setlecomplete() were fixed correctly in the same commit.

This causes a memory leak of the mgmtpendingcmd structure and its associated parameter data for each SSP command that completes.

Add the missing mgmtpendingfree(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in setadvertisingcomplete().