CVE-2026-43017: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43017 Overview

CVE-2026-43017 is a Linux kernel vulnerability in the Bluetooth Management (MGMT) subsystem. The flaw resides in the mesh_send() function, which handles the MGMT_OP_MESH_SEND operation for queuing mesh advertising payloads. The function bounds the request by total command length but never verifies that the bytes supplied for the flexible adv_data[] array match the embedded adv_data_len field. A truncated command can pass the existing 20–50 byte range check and later drive the asynchronous mesh send path past the end of the queued command buffer, resulting in an out-of-bounds read [CWE-125].

Critical Impact
A local user with access to the Bluetooth MGMT socket can trigger an out-of-bounds read in kernel memory by submitting a mesh send command with a mismatched adv_data_len field, potentially leading to information disclosure or kernel instability.

Affected Products

Linux kernel (Bluetooth MGMT subsystem)
Distributions shipping kernels with MGMT_OP_MESH_SEND support prior to the patch commits
Systems exposing the Bluetooth management interface to local users or services

Discovery Timeline

2026-05-01 - CVE-2026-43017 published to NVD
2026-05-01 - Last updated in NVD database

Technical Details for CVE-2026-43017

Vulnerability Analysis

The vulnerability exists in the Bluetooth MGMT handler mesh_send() within the Linux kernel. The handler accepts an MGMT_OP_MESH_SEND command containing a fixed header followed by a flexible adv_data[] array. The header carries an adv_data_len field that declares the size of the trailing payload.

The original code only validates that the entire command length falls within the 20–50 byte range defined by MGMT_MESH_SEND_SIZE plus the maximum advertising payload. It does not cross-check adv_data_len against the actual trailing bytes available in the command buffer. As a result, a caller can declare an adv_data_len larger than the bytes supplied, and the asynchronous send path later reads beyond the end of the queued command buffer when constructing the advertising frame.

Root Cause

The root cause is missing input validation between two related length fields. MGMT_MESH_SEND_SIZE covers only the fixed header, so the existing range check on total command length is insufficient to guarantee that adv_data_len bytes are actually present after the header. The flexible array is consumed asynchronously, decoupled from the original validation context, which makes the buffer over-read reachable through normal scheduling of the mesh send work.

Attack Vector

An attacker with permission to open and write to the Bluetooth MGMT socket can craft a malformed MGMT_OP_MESH_SEND command. The command sets adv_data_len to a value that does not match the trailing payload size. The kernel queues the request, and the async send path subsequently reads past the queued buffer when emitting the advertisement. Exploitation requires local access to the MGMT interface and Bluetooth capability on the target system.

The fix retains existing rejection of zero-length and oversized advertising payloads, validates adv_data_len explicitly, and requires the command length to exactly match the flexible array size before queuing the request. See the upstream patches for implementation details, including commit 0b706fb2294a and commit 244b639e6a3a.

Detection Methods for CVE-2026-43017

Indicators of Compromise

Unexpected kernel warnings, KASAN reports, or oops messages referencing mesh_send, mgmt_mesh_send, or the Bluetooth MGMT subsystem in dmesg or journalctl -k.
Unprivileged or unexpected processes opening AF_BLUETOOTH sockets with the HCI control channel and issuing MGMT_OP_MESH_SEND commands.
Repeated Bluetooth subsystem crashes or HCI controller resets correlated with userspace activity from non-Bluetooth daemons.

Detection Strategies

Audit running kernel versions across the fleet and compare against fixed stable branch commits referenced in the CVE.
Monitor auditd for socket(AF_BLUETOOTH, ...) calls from processes outside the expected Bluetooth stack (bluetoothd, bluetooth-mesh).
Enable KASAN on test kernels to surface out-of-bounds reads in the MGMT mesh path during fuzzing or canary deployments.

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized logging or SIEM platform and alert on Bluetooth subsystem panics, oops, or KASAN signatures.
Track package updates for the kernel and linux-firmware to confirm patched versions are deployed on Bluetooth-enabled hosts.
Inventory systems with active Bluetooth radios and MGMT exposure, especially mobile, IoT, and edge devices that support BLE Mesh.

How to Mitigate CVE-2026-43017

Immediate Actions Required

Apply the upstream stable kernel updates that include the mesh_send() length validation fix as soon as your distribution publishes them.
On systems that do not require BLE Mesh, disable Bluetooth or restrict access to the MGMT socket to trusted users only.
Restrict CAP_NET_ADMIN and CAP_NET_RAW to required service accounts to limit who can issue MGMT commands.

Patch Information

The vulnerability is resolved in upstream Linux kernel commits that add explicit validation of adv_data_len and require the command length to exactly match the size of the flexible advertising payload. Backports are available across multiple stable branches via commit 24fa32369cf1, commit 562ed1954f0c, commit bda93eec78cd, and commit edb5898cfa91. Track your distribution's security advisories and rebase to a kernel containing these commits.

Workarounds

Unload the bluetooth kernel module on systems that do not require Bluetooth functionality: modprobe -r bluetooth.
Blacklist the Bluetooth modules in /etc/modprobe.d/ to prevent automatic loading on reboot.
Use mandatory access control policies such as SELinux or AppArmor to restrict which processes can open Bluetooth MGMT sockets.

bash

# Disable Bluetooth on systems that do not require BLE Mesh
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service
echo "blacklist bluetooth" | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo "blacklist btusb" | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo modprobe -r btusb bluetooth 2>/dev/null || true