CVE-2026-43017: Linux kernel · Bluetooth: MGMT: validate mesh send advertising payload length
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in edb5898cfa91afe7e8f83eda18d93034c953d632 : update Linux kernel when convenient.
Data as of 6 Nov 2026, 16:33 UTC
Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in edb5898cfa91afe7e8f83eda18d93034c953d632, bda93eec78cdbfe5cda00785cefebd443e56b88b, 562ed1954f0c1bff3422b7b752bd3dacf185edbf +3
Exploitation evidence
Disclosed: evidence found.
CVE published 1 May 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix for this vulnerability is available in the Linux kernel. Users should update to a fixed kernel version containing the patches identified by the provided commit hashes. No additional mitigation steps are required beyond applying the official fix.
Description
A vulnerability in the Linux kernel Bluetooth mesh management code allows improper validation of the advertising payload length in mesh send commands. The issue arises because the flexible adv_data[] array length is not properly checked against the embedded adv_data_len field, potentially causing the asynchronous mesh send path to read beyond the command buffer. The flaw is fixed by explicitly validating adv_data_len and requiring the command length to exactly match the flexible array size before queueing the request.
References
- git.kernel.org/stable/c/24fa32369cf15d8fc918bdfe94097b12e6acada0 (opens in a new tab)
- git.kernel.org/stable/c/244b639e6a3a8e26241e201004a3a9f764476631 (opens in a new tab)
- git.kernel.org/stable/c/0b706fb2294aff3adfd54653bda1b5e356ad4566 (opens in a new tab)
- git.kernel.org/stable/c/edb5898cfa91afe7e8f83eda18d93034c953d632 (opens in a new tab)
- git.kernel.org/stable/c/562ed1954f0c1bff3422b7b752bd3dacf185edbf (opens in a new tab)
- git.kernel.org/stable/c/bda93eec78cdbfe5cda00785cefebd443e56b88b (opens in a new tab)