CVE-2026-43059
published 2026-05-05CVE-2026-43059: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced
mgmt_pending_valid(), which not only validates the pending command but
also unlinks it from the pending list if it is valid. This change in
semantics requires updates to several completion handlers to avoid list
corruption and memory safety issues.
This patch addresses two left-over issues from the aforementioned rework:
1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove()
is replaced with mgmt_pending_free() in the success path. Since
mgmt_pending_valid() already unlinks the command at the beginning of
the function, calling mgmt_pending_remove() leads to a double list_del()
and subsequent list corruption/kernel panic.
2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error
path is removed. Since the current command is already unlinked by
mgmt_pending_valid(), this foreach loop would incorrectly target other
pending mesh commands, potentially freeing them while they are still being
processed concurrently (leading to UAFs). The redundant mgmt_cmd_status()
is also simplified to use cmd->opcode directly.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 302a1f674c00dd5581ab8e493ef44767c5101aab < b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77 | b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77 |
| linux | linux | >= 302a1f674c00dd5581ab8e493ef44767c5101aab < 02023ff760cc104a5d86a82ef5b8dd89098ad78d | 02023ff760cc104a5d86a82ef5b8dd89098ad78d |
| linux | linux | >= 302a1f674c00dd5581ab8e493ef44767c5101aab < 17f89341cb4281d1da0e2fb0de5406ab7c4e25ef | 17f89341cb4281d1da0e2fb0de5406ab7c4e25ef |
| linux | linux | >= 6.12.59 < 6.12.78 | 6.12.78 |
| linux | linux | >= 6.16.10 < 6.17 | 6.17 |
| linux | linux | >= 6.6.140 < 6.7 | 6.7 |
| linux | linux | >= d71b98f253b079cbadc83266383f26fe7e9e103b < 695b45b2262fcb5e71bed1175aad59c72f92aa78 | 695b45b2262fcb5e71bed1175aad59c72f92aa78 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.12.59 < 6.12.78 | 6.12.78 |
| linux | linux_kernel | >= 6.16.10 < 6.17 | 6.17 |
| linux | linux_kernel | >= 6.17.1 < 6.18.20 | 6.18.20 |
| linux | linux_kernel | >= 6.19 < 6.19.10 | 6.19.10 |
| linux | linux_kernel | >= 6.6.140 < 6.7 | 6.7 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
vendor_redhat·2026-05-05·CVSS 7.0
CVE-2026-43059 [MEDIUM] CWE-825 kernel: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
kernel: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. This vulnerability arises from incorrect handling of pending commands within the Bluetooth subsystem's command completion processes. An attacker with local access could exploit this issue to trigger memory corruption and Use-After-Free (UAF) conditions, potentially leading to a kernel panic and a Denial of Service (DoS) for the system. Use-After-Free is a memory safety flaw where a program attempts to use memory after it has been freed, which can lead to unpredictable behavior or system crashes.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (R
GHSA
GHSA-9xxq-2x8g-75gf: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
Commit
ghsa_unreviewed·2026-05-05
CVE-2026-43059 GHSA-9xxq-2x8g-75gf: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
Commit
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers
Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced
mgmt_pending_valid(), which not only validates the pending command but
also unlinks it from the pending list if it is valid. This change in
semantics requires updates to several completion handlers to avoid list
corruption and memory safety issues.
This patch addresses two left-over issues from the aforementioned rework:
1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove()
is replaced with mgmt_pending_free() in the success path. Since
mgmt_pending_valid() already unlinks the command at the beginning of
the function, calling mgmt_pending_remove() leads to a dou
VulDB
Linux Kernel up to 6.12.77/6.18.19/6.19.9 Bluetooth mgmt_pending_valid use after free
vuldb·2026-05-05
CVE-2026-43059 [CRITICAL] Linux Kernel up to 6.12.77/6.18.19/6.19.9 Bluetooth mgmt_pending_valid use after free
A vulnerability was found in Linux Kernel up to 6.12.77/6.18.19/6.19.9. It has been rated as critical. Impacted is the function mgmt_pending_valid of the component Bluetooth. Performing a manipulation results in use after free.
This vulnerability is cataloged as CVE-2026-43059. The attack must originate from the local network. There is no exploit available.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-05-05
Published