The Linux kernel contained a vulnerability in the Bluetooth MGMT mesh_send() function where the flexible adv_data[] array's length was not properly validated against the embedded adv_data_len field. Although the total command length was bounded, the code did not verify that the actual bytes supplied matched adv_data_len, allowing truncated commands to pass existing range checks. This could cause the asynchronous mesh send path to read past the end of the queued command buffer, leading to potential memory corruption or denial of service. The issue was fixed by explicitly validating adv_data_len and requiring the command length to exactly match the flexible array size before queueing the request. This vulnerability is tracked as CVE-2026-43017 and affects various linux-hwe-edge kernel versions prior to 6.8.0 and related builds.

The vulnerability does not impact confidentiality or integrity but can cause availability impact by triggering a denial of service through kernel crashes or memory corruption when malformed Bluetooth mesh advertising payloads are processed. The CVSS score of 5.5 (medium severity) reflects this availability impact with local attacker privileges required and no user interaction needed.

An official patch is available and included in Linux kernel versions 6.8.0 and later and related builds. Users should update their Linux kernel to a fixed version and reboot the system to apply the changes. Due to ABI changes, third-party kernel modules may need recompilation and reinstallation after the update. No additional mitigations are required beyond applying the official fix.