CVE-2026-43017 is a medium severity vulnerability in the Linux kernel's Bluetooth mesh management. It involves improper validation of the advertising payload length in mesh send commands, which can lead to asynchronous mesh send operations reading beyond the command buffer. The flaw is due to the flexible adv_data array length not being explicitly checked against the embedded adv_data_len field, allowing truncated commands to bypass length checks.