CVE-2026-31511 is a use-after-free vulnerability in the Linux kernel Bluetooth MGMT subsystem caused by a dangling pointer on mgmt_add_adv_patterns_monitor_complete. The issue arises when mgmt_pending_free(cmd) frees memory without unlinking it from the list if status equals -ECANCELED, leading to potential dereferencing of freed memory during subsequent list traversals. This vulnerability affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related builds. The flaw has been resolved in updated Linux kernel packages. The CVSS 3.1 base score is 7.8 with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attacker with low privileges can cause high impact on confidentiality, integrity, and availability. The vendor advisory from Ubuntu confirms the availability of patches and advises rebooting after update and recompiling third-party kernel modules due to ABI changes.

Successful exploitation can lead to use-after-free conditions causing potential memory corruption, which may result in system compromise affecting confidentiality, integrity, and availability. The CVSS score of 7.8 reflects high severity. The vulnerability requires local access with low privileges and no user interaction. No known exploits in the wild have been reported.

A patch is available and should be applied promptly. Users should update their Linux kernel to versions at or above 6.8.0-1064.72 or the corresponding fixed builds. After updating, a system reboot is required to apply changes. Due to an ABI change in the kernel update, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for updating and recompiling modules. No additional mitigation is indicated by the vendor advisory.