CVE-2026-43059

{"id": "CVE-2026-43059", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43059", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-06T15:27:32.990418Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a", "lessThan": "3d6de8467236cd763ddc7d06127689bdfbfbd8ff", "versionType": "git"}, {"status": "affected", "version": "d71b98f253b079cbadc83266383f26fe7e9e103b", "lessThan": "695b45b2262fcb5e71bed1175aad59c72f92aa78", "versionType": "git"}, {"status": "affected", "version": "302a1f674c00dd5581ab8e493ef44767c5101aab", "lessThan": "b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77", "versionType": "git"}, {"status": "affected", "version": "302a1f674c00dd5581ab8e493ef44767c5101aab", "lessThan": "02023ff760cc104a5d86a82ef5b8dd89098ad78d", "versionType": "git"}, {"status": "affected", "version": "302a1f674c00dd5581ab8e493ef44767c5101aab", "lessThan": "17f89341cb4281d1da0e2fb0de5406ab7c4e25ef", "versionType": "git"}, {"status": "affected", "version": "87a1f16f07c6c43771754075e08f45b41d237421", "versionType": "git"}, {"status": "affected", "version": "6.6.140", "lessThan": "6.6.160", "versionType": "semver"}, {"status": "affected", "version": "6.12.59", "lessThan": "6.12.78", "versionType": "semver"}, {"status": "affected", "version": "6.16.10", "lessThan": "6.17", "versionType": "semver"}], "programFiles": ["net/bluetooth/mgmt.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"status": "unaffected", "version": "0", "lessThan": "6.17", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.78", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/mgmt.c"], "defaultStatus": "affected"}]}], "published": "2026-05-05T16:16:14.927", "references": [{"url": "https://git.kernel.org/stable/c/02023ff760cc104a5d86a82ef5b8dd89098ad78d", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/3d6de8467236cd763ddc7d06127689bdfbfbd8ff", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/695b45b2262fcb5e71bed1175aad59c72f92aa78", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-416"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix list corruption and UAF in command complete handlers\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") introduced\nmgmt_pending_valid(), which not only validates the pending command but\nalso unlinks it from the pending list if it is valid. This change in\nsemantics requires updates to several completion handlers to avoid list\ncorruption and memory safety issues.\n\nThis patch addresses two left-over issues from the aforementioned rework:\n\n1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove()\nis replaced with mgmt_pending_free() in the success path. Since\nmgmt_pending_valid() already unlinks the command at the beginning of\nthe function, calling mgmt_pending_remove() leads to a double list_del()\nand subsequent list corruption/kernel panic.\n\n2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error\npath is removed. Since the current command is already unlinked by\nmgmt_pending_valid(), this foreach loop would incorrectly target other\npending mesh commands, potentially freeing them while they are still being\nprocessed concurrently (leading to UAFs). The redundant mgmt_cmd_status()\nis also simplified to use cmd->opcode directly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: MGMT: Correcci\u00f3n de corrupci\u00f3n de lista y UAF en los manejadores de finalizaci\u00f3n de comandos\n\nEl commit 302a1f674c00 (\u2019Bluetooth: MGMT: Correcci\u00f3n de posibles UAF\u2019) introdujo mgmt_pending_valid(), que no solo valida el comando pendiente sino que tambi\u00e9n lo desvincula de la lista de pendientes si es v\u00e1lido. Este cambio en la sem\u00e1ntica requiere actualizaciones en varios manejadores de finalizaci\u00f3n para evitar la corrupci\u00f3n de la lista y problemas de seguridad de la memoria.\n\nEste parche aborda dos problemas restantes del redise\u00f1o mencionado:\n\n1. En mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove() es reemplazado por mgmt_pending_free() en la ruta de \u00e9xito. Dado que mgmt_pending_valid() ya desvincula el comando al principio de la funci\u00f3n, llamar a mgmt_pending_remove() conduce a un doble list_del() y a la subsiguiente corrupci\u00f3n de la lista/kernel panic.\n\n2. En set_mesh_complete(), el uso de mgmt_pending_foreach() en la ruta de error es eliminado. Dado que el comando actual ya est\u00e1 desvinculado por mgmt_pending_valid(), este bucle foreach apuntar\u00eda incorrectamente a otros comandos mesh pendientes, potencialmente liber\u00e1ndolos mientras a\u00fan est\u00e1n siendo procesados concurrentemente (lo que lleva a UAF). El mgmt_cmd_status() redundante tambi\u00e9n se simplifica para usar cmd -> opcode directamente."}], "lastModified": "2026-11-11T21:10:00.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "432FEB2A-EE4B-41CC-BD3B-22D6680FA2AC", "versionEndExcluding": "6.7", "versionStartIncluding": "6.6.140"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C6E44F9-3E53-4331-A4D5-B31041365D22", "versionEndExcluding": "6.12.78", "versionStartIncluding": "6.12.59"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C91278E-7FC3-4EFB-AE2C-E82D42F4D3AA", "versionEndExcluding": "6.17", "versionStartIncluding": "6.16.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7ED31AF6-5D81-4EE0-84BE-89EDBCE41784", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.17.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}