CVE-2026-43017 Details
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate mesh send advertising payload length mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer. Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request.
A vulnerability exists in the Linux kernel's Bluetooth management layer, specifically within the mesh sending functionality. The issue arises because the 'mesh_send' function does not properly validate the length of the advertising data payload before processing it. Although the function checks the total command length, it fails to ensure that the flexible 'adv_data' array matches the specified 'adv_data_len' field. This oversight can lead to a buffer overflow, as a truncated command may pass the initial length checks and then drive the asynchronous mesh sending process beyond the end of the queued command buffer. The vulnerability affects several versions of the Linux kernel.
Users should update to the latest version of the Linux kernel where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0b706fb2294aff3adfd54653bda1b5e356ad4566 | kernel.org | Patch |
| https://git.kernel.org/stable/c/244b639e6a3a8e26241e201004a3a9f764476631 | kernel.org | Patch |
| https://git.kernel.org/stable/c/24fa32369cf15d8fc918bdfe94097b12e6acada0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/562ed1954f0c1bff3422b7b752bd3dacf185edbf | kernel.org | Patch |
| https://git.kernel.org/stable/c/bda93eec78cdbfe5cda00785cefebd443e56b88b | kernel.org | Patch |
| https://git.kernel.org/stable/c/edb5898cfa91afe7e8f83eda18d93034c953d632 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.1, < 6.1.168 >= 6.2, < 6.6.134 >= 6.7, < 6.12.81 >= 6.13, < 6.18.22 >= 6.19, < 6.19.12 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 7.0 rc6 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 8, 2026 | Initial Analysis | [email protected] |
| May 1, 2026 | New CVE Received | kernel.org |