CVE-2026-43059

What it actually does

This is a Linux kernel memory-safety flaw in the Bluetooth Management (MGMT) command completion path. A pending Bluetooth MGMT command can be unlinked from the kernel pending-command list by mgmt_pending_valid(), but some completion handlers continued to treat it as still linked. In the affected paths, this can cause double list deletion, list corruption, kernel panic, or freeing of another pending mesh command that is still in use, creating a use-after-free condition. The most likely technical outcomes are local denial of service through a kernel crash and, depending on timing, allocator state, kernel configuration, and reachable Bluetooth MGMT operations, possible memory corruption with elevated execution in kernel context.

Why it matters to the business

Systems with affected Linux kernels and enabled Bluetooth management functionality may be vulnerable to local disruption. The practical business risk is unexpected host crashes, service interruption, and reduced reliability on laptops, desktops, embedded Linux devices, gateways, or servers where Bluetooth is present and exposed to local users or privileged services. The current public exploitation signal is low: EPSS is 0.00122 with no 30-day increase, it is not listed in CISA KEV, and no mature public exploit is indicated. However, kernel memory-safety issues should still be prioritized on systems where local users, containers with access to Bluetooth control interfaces, kiosk users, or untrusted applications can interact with Bluetooth management APIs.

How an attack unfolds

An attacker first needs a way to issue or influence Linux Bluetooth MGMT commands on an affected system. This generally requires local access and sufficient permission to interact with the kernel Bluetooth control interface, or compromise of a local process that already has that capability. The attacker then triggers specific Bluetooth MGMT command sequences involving advertising pattern monitor completion or mesh setup completion. Because the vulnerable kernel code unlinks a pending command during validation and later performs operations that assume the command remains linked, the completion handler can corrupt the pending-command list or free an object still being used by another command path. In a straightforward attack, the result is a kernel panic and system crash. In a more advanced scenario, an attacker would attempt to shape timing and heap allocation behavior to turn the use-after-free into controlled kernel memory corruption, though no mature public exploit is currently reported.

How to fix it

Upgrade to a kernel version that contains the upstream fix for the Bluetooth MGMT command completion handlers. Because no specific affected product list or fixed package versions were provided, use the fixed kernel supplied by the relevant Linux distribution or vendor advisory for this CVE. Where immediate patching is not possible, reduce exposure by disabling Bluetooth on systems that do not require it, unloading or blacklisting Bluetooth kernel modules where operationally acceptable, blocking untrusted local users from Bluetooth control interfaces, and restricting containers or sandboxes from accessing host Bluetooth devices, AF_BLUETOOTH sockets, or management/control capabilities. Treat these mitigations as temporary; the durable fix is a patched kernel.

How to confirm the fix worked

Confirm that systems are running a vendor kernel build that includes the fix for the Bluetooth MGMT handlers, specifically the change replacing the erroneous mgmt_pending_remove() success-path behavior with safe freeing and removing the unsafe mesh pending-command iteration in the error path. Validate exposure by checking whether Bluetooth support is enabled, whether Bluetooth adapters are present, and whether local users or workloads can access Bluetooth management interfaces. After remediation, reboot into the patched kernel and verify the active kernel version, not only the installed package version. For source-built kernels, confirm that the Bluetooth MGMT code contains the corrected handling in mgmt_add_adv_patterns_monitor_complete() and set_mesh_complete().

Typical attack path

1. Identify a Linux host running an affected kernel with Bluetooth support enabled.
2. Gain local execution or control of a process that can access the Bluetooth management interface.
3. Issue or race Bluetooth MGMT operations related to advertising monitor patterns or mesh configuration.
4. Trigger the vulnerable command completion handler after mgmt_pending_valid() has already unlinked the pending command.
5. Cause double list deletion, pending-list corruption, or use-after-free of another pending command.
6. Crash the kernel, or attempt further heap manipulation to convert memory corruption into privilege escalation.

How to detect it

Look for evidence of attempted or successful exploitation in kernel logs, system journals, crash dumps, and endpoint telemetry. Useful sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, /var/crash, kdump/vmcore artifacts, systemd-coredump metadata, EDR process timelines, and audit logs showing processes accessing Bluetooth devices or management sockets before a crash. Focus on kernel warnings or panics involving Bluetooth MGMT, list corruption, double deletion, use-after-free, KASAN/KFENCE reports, or functions named mgmt_add_adv_patterns_monitor_complete, set_mesh_complete, mgmt_pending_valid, mgmt_pending_remove, mgmt_pending_free, and mgmt_pending_foreach. Also correlate unexpected reboots or kernel panics with recent Bluetooth activity, mesh configuration attempts, advertising monitor operations, hciconfig/bluetoothctl/btmgmt usage, or processes opening Bluetooth control interfaces. There are no known public malware-specific indicators or named threat actor patterns for this vulnerability in the provided intelligence.

• mgmt_add_adv_patterns_monitor_complete
• set_mesh_complete
• mgmt_pending_valid
• mgmt_pending_remove
• mgmt_pending_free
• mgmt_pending_foreach
• Bluetooth: MGMT
• list_del corruption
• list_add corruption
• kernel BUG at lib/list_debug.c
• KASAN: use-after-free
• BUG: KASAN: use-after-free
• KFENCE: use-after-free
• general protection fault
• kernel panic
• Oops:
• btmgmt
• bluetoothctl
• /var/crash
• /proc/vmcore
• /sys/class/bluetooth
• /dev/rfkill

What your security team should do

• Prioritize patching Linux systems that have Bluetooth enabled and allow local interactive users, kiosk users, developers, untrusted applications, or containers with device access.
• Apply vendor kernel updates and reboot systems so the fixed kernel is actually running.
• Disable Bluetooth on servers and production systems where it is not required.
• Restrict access to Bluetooth devices and management interfaces from containers, virtualized workloads, and sandboxed applications unless explicitly needed.
• Monitor kernel logs for Bluetooth MGMT-related crashes, list corruption, use-after-free warnings, KASAN reports, and unexpected reboots.
• Because exploitation maturity and EPSS are currently low and the issue is not in KEV, track it as medium operational urgency unless Bluetooth is broadly enabled on multi-user or physically accessible systems.
• Add this CVE to kernel vulnerability management workflows and verify fixed kernel rollout through endpoint inventory rather than package installation status alone.