CVE-2026-43017

Vulnerability

Details

The Linux kernel's Bluetooth subsystem contains an out-of-bounds read vulnerability in the mesh_send() handler for MGMT_OP_MESH_SEND. The function validates the overall command length against MGMT_MESH_SEND_SIZE but fails to verify that the embedded adv_data_len field matches the actual size of the flexible array adv_data[]. This allows a crafted command with a mismatched adv_data_len to pass the length check [1].

Exploitation

An attacker with local access and the CAP_NET_ADMIN capability (or root privileges) can send a malicious MGMT_OP_MESH_SEND command to the kernel. By providing a truncated command where adv_data_len exceeds the remaining buffer, the kernel will later attempt to read beyond the allocated memory when processing the mesh advertising payload. No user interaction is required beyond sending the crafted command.

Impact

Successful exploitation leads to an out-of-bounds read from kernel heap memory, potentially leaking sensitive information. In some configurations, this may also cause a kernel panic (denial of service). The vulnerability is rated Medium (CVSS 5.5) due to the requirement for local access and elevated privileges.

Mitigation

The fix has been applied to the Linux kernel stable tree [1]. Users should update to a kernel version containing the commit that adds explicit validation of adv_data_len and ensures the command length exactly matches the flexible array size. No workaround is available.