Riskcovery

CVE-2026-43017

Bluetooth: MGMT: validate mesh send advertising payload length

State
Published
Severity
Not scored
Published
May 1, 2026
Updated
May 11, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate mesh send advertising payload length

mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer.

Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before 24fa32369cf15d8fc918bdfe94097b12e6acada0Affected
  • b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before 244b639e6a3a8e26241e201004a3a9f764476631Affected
  • b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before 0b706fb2294aff3adfd54653bda1b5e356ad4566Affected
  • b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before edb5898cfa91afe7e8f83eda18d93034c953d632Affected
  • b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before 562ed1954f0c1bff3422b7b752bd3dacf185edbfAffected
  • b338d91703fae6f6afd67f3f75caa3b8f36ddef3 to before bda93eec78cdbfe5cda00785cefebd443e56b88bAffected
LinuxLinux
  • 6.1Affected
  • before 6.1Not affected
  • 6.1.168 through 6.1.*Not affected
  • 6.6.134 through 6.6.*Not affected
  • 6.12.81 through 6.12.*Not affected
  • 6.18.22 through 6.18.*Not affected
  • 6.19.12 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.