CVE-2026-43059 addresses a vulnerability in the Linux kernel Bluetooth MGMT subsystem where changes introduced by commit 302a1f674c00 altered the semantics of mgmt_pending_valid(), which unlinks commands from the pending list if valid. Some completion handlers were not updated accordingly, causing double list removal operations and use-after-free conditions. Specifically, mgmt_add_adv_patterns_monitor_complete() improperly called mgmt_pending_remove() after mgmt_pending_valid() had already unlinked the command, leading to list corruption and potential kernel panic. Similarly, set_mesh_complete() used mgmt_pending_foreach() on already unlinked commands, risking memory safety issues. The patch corrects these handlers to prevent list corruption and UAF. This vulnerability affects various Linux kernel versions prior to 6.8.x as used in the linux-hwe-edge product. The CVSS 3.1 score is 7.8 (High) with local attack vector, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. A vendor-provided patch is available and should be applied.

Successful exploitation could cause kernel list corruption and use-after-free conditions in the Bluetooth management subsystem, potentially leading to kernel panics, system instability, or arbitrary code execution with kernel privileges. The vulnerability impacts confidentiality, integrity, and availability of affected systems. The CVSS score of 7.8 reflects a high-severity issue requiring prompt remediation.

A patch is available from the vendor and should be applied promptly via standard system updates. After updating the Linux kernel to the fixed versions, a system reboot is required to activate the fixes. Due to an ABI change in the kernel update, all third-party kernel modules must be recompiled and reinstalled. Follow the vendor advisory instructions for updating and recompiling kernel modules to ensure full remediation.