Bluetooth Mesh Advertising Payload Vulnerability in Linux Kernel

CVE-2026-43017

What is CVE-2026-43017?

A vulnerability exists in the Linux kernel's Bluetooth stack, specifically related to the handling of mesh advertising payloads. The function mesh_send() fails to validate that the length of the flexible adv_data[] array corresponds correctly with the embedded adv_data_len field. While the system checks the total command length against a predefined range, this does not prevent malicious actors from exploiting truncated commands. If improperly validated, these commands can exceed the bounds of the command buffer. The vulnerability necessitates stricter checks to ensure that both the command length and the adv_data_len are accurately matched before the request is queued, maintaining robust system integrity against potential payload manipulation.

References