CVE-2026-43059

Vulnerability

Overview

CVE-2026-43059 is a memory safety vulnerability in the Linux kernel's Bluetooth MGMT subsystem. The root cause is a semantic mismatch introduced by commit 302a prior commit (302a1f674c00) that changed mgmt_pending_valid() to both validate and unlink a pending command from the list. Two completion handlers were not updated to match this new behavior, leading to list corruption and use-after-free (UAF) conditions [1][2].

Exploitation

Details

The vulnerability manifests in two specific code paths: 1. In mgmt_add_adv_patterns_monitor_complete(), the success path calls mgmt_pending_remove() after mgmt_pending_pending_valid() has already unlinked the command. This results in a double list deletion (list_del()), corrupting the kernel's the pending list and potentially causing a kernel panic [1][2]. 2. In set_mesh_complete(), the error path uses mgmt_pending_foreach() to iterate over pending mesh commands. Because the current command is already unlinked by mgmt_pending_valid(), this loop may incorrectly target other concurrently processed mesh commands, freeing them while they are still in use and leading to UAF [1][2].

Both issues require the ability to trigger the affected MGMT command sequences, which typically requires local access and the CAP_NET_ADMIN capability or root privileges.

Impact

An attacker with sufficient privileges could exploit these flaws to corrupt kernel memory, cause a denial of service (system crash), or potentially escalate privileges by manipulating freed memory objects. The UAF in the mesh path is particularly dangerous as it may allow an attacker to overwrite freed kernel structures.

Mitigation

The fixes are included in Linux kernel stable commits that replace the problematic calls with correct alternatives: mgmt_pending_free() instead of mgmt_pending_remove() in the advertising monitor path, and removal of the mgmt_pending_foreach() loop in the mesh path [1][2][3][4]. Users should apply the latest kernel updates from their distribution or the stable kernel tree. No workaround is available; patching is required.