CVE-2026-43017

Summary

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate mesh send advertising payload length

mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer.

Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxb338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 24fa32369cf15d8fc918bdfe94097b12e6acada0affected
LinuxLinuxb338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 244b639e6a3a8e26241e201004a3a9f764476631affected
LinuxLinuxb338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 0b706fb2294aff3adfd54653bda1b5e356ad4566affected
LinuxLinuxb338d91703fae6f6afd67f3f75caa3b8f36ddef3 < edb5898cfa91afe7e8f83eda18d93034c953d632affected
LinuxLinuxb338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 562ed1954f0c1bff3422b7b752bd3dacf185edbfaffected
LinuxLinuxb338d91703fae6f6afd67f3f75caa3b8f36ddef3 < bda93eec78cdbfe5cda00785cefebd443e56b88baffected
LinuxLinux6.1affected
LinuxLinux0 < 6.1unaffected
LinuxLinux6.1.168 <= 6.1.*unaffected
LinuxLinux6.6.134 <= 6.6.*unaffected
LinuxLinux6.12.81 <= 6.12.*unaffected
LinuxLinux6.18.22 <= 6.18.*unaffected
LinuxLinux6.19.12 <= 6.19.*unaffected
LinuxLinux7.0 <= *unaffected

Weaknesses

References