Executive brief
A vulnerability in the Linux kernel's Bluetooth management component could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue stems from how the system handles pending Bluetooth commands, leading to memory corruption. This could result in a complete service outage (kernel panic) or a compromise of the operating system's integrity.
Technical details
A vulnerability exists in the Linux kernel Bluetooth MGMT layer due to incorrect semantics in the mgmt_pending_valid() function. This function unlinks a pending command from the list, but subsequent calls in completion handlers like mgmt_add_adv_patterns_monitor_complete() and set_mesh_complete() attempted to remove or iterate over the same command again. This leads to a double list_del() causing kernel panics or a use-after-free (UAF) where concurrent mesh commands are incorrectly freed. An attacker with local access could exploit this to cause a Denial of Service or escalate privileges. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux kernel 6.6.140 to 6.7, 6.12.59 to 6.12.78, 6.16.10 to 6.17, 6.17.1 to 6.18.20, 6.19 to 6.19.10
Timeline
- 2026-05-05: disclosed: Initial publication date
- 2026-03-25: patched: Patched in stable kernel trees