Executive brief
A vulnerability in the Linux kernel's Bluetooth management component could allow a local user to crash the system or potentially execute unauthorized code. This issue affects systems using Bluetooth Mesh functionality. An exploit could lead to a complete system failure or unauthorized access to sensitive kernel memory.
Technical details
This vulnerability consists of two distinct issues within the Bluetooth MGMT interface: a stack-based out-of-bounds access in 'set_mesh_sync' and a double-free (double list_del) in 'set_mesh_complete'. The out-of-bounds access is caused by an incorrect declaration of a flexible array member on the stack, leading to a buffer overflow during a 'memcpy' operation. The second issue involves improper list management where a pending command is removed twice from a linked list. A local attacker with low privileges can trigger these flaws to cause a kernel panic (DoS) or potentially achieve local privilege escalation. The issues have been resolved by using 'DEFINE_FLEX' for proper array handling and correcting the list removal logic.
Affected products
- Linux Linux Kernel 6.17 to 6.17.7, 6.6.140 to 6.7
Timeline
- 2025-10-03: other: Patch authored
- 2025-11-24: advisory: CVE published