CVE-2026-43017
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate mesh send advertising payload length mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer. Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request.
How to fix
- linux linux_kernel6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12 or later
- git.kernel.org/stable/c/0b706fb2294aff3adfd54653bda1b5e356ad4566
- git.kernel.org/stable/c/244b639e6a3a8e26241e201004a3a9f764476631
- git.kernel.org/stable/c/24fa32369cf15d8fc918bdfe94097b12e6acada0
- git.kernel.org/stable/c/562ed1954f0c1bff3422b7b752bd3dacf185edbf
- git.kernel.org/stable/c/bda93eec78cdbfe5cda00785cefebd443e56b88b
- git.kernel.org/stable/c/edb5898cfa91afe7e8f83eda18d93034c953d632
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 6.1 ≤ v < 6.1.168, 6.2 ≤ v < 6.6.134, 6.7 ≤ v < 6.12.81, 6.13 ≤ v < 6.18.22, 6.19 ≤ v < 6.19.12, 7.0 | 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.