Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-43059
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-05-05 16:16:14 UTC
Updated2026-05-06 13:08:07 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced mgmt_pending_valid(), which not only validates the pending command but also unlinks it from the pending list if it is valid. This change in semantics requires updates to several completion handlers to avoid list corruption and memory safety issues. This patch addresses two left-over issues from the aforementioned rework: 1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove() is replaced with mgmt_pending_free() in the success path. Since mgmt_pending_valid() already unlinks the command at the beginning of the function, calling mgmt_pending_remove() leads to a double list_del() and subsequent list corruption/kernel panic. 2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error path is removed. Since the current command is already unlinked by mgmt_pending_valid(), this foreach loop would incorrectly target other pending mesh commands, potentially freeing them while they are still being processed concurrently (leading to UAFs). The redundant mgmt_cmd_status() is also simplified to use cmd->opcode directly.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected d71b98f253b079cbadc83266383f26fe7e9e103b 695b45b2262fcb5e71bed1175aad59c72f92aa78 git Not specified
CNA Linux Linux affected 302a1f674c00dd5581ab8e493ef44767c5101aab b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77 git Not specified
CNA Linux Linux affected 302a1f674c00dd5581ab8e493ef44767c5101aab 02023ff760cc104a5d86a82ef5b8dd89098ad78d git Not specified
CNA Linux Linux affected 302a1f674c00dd5581ab8e493ef44767c5101aab 17f89341cb4281d1da0e2fb0de5406ab7c4e25ef git Not specified
CNA Linux Linux affected 87a1f16f07c6c43771754075e08f45b41d237421 git Not specified
CNA Linux Linux affected 6.17 Not specified
CNA Linux Linux unaffected 6.17 semver Not specified
CNA Linux Linux unaffected 6.12.78 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.20 6.18.* semver Not specified
CNA Linux Linux unaffected 6.19.10 6.19.* semver Not specified
CNA Linux Linux unaffected 7.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/695b45b2262fcb5e71bed1175aad59c72f92aa78 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/02023ff760cc104a5d86a82ef5b8dd89098ad78d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report