CVE-2026-43017: Bluetooth: MGMT: validate mesh send advertising payload length
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate mesh send advertising payload length
meshsend() currently bounds MGMTOPMESHSEND by total command length, but it never verifies that the bytes supplied for the flexible advdata[] array actually match the embedded advdatalen field. MGMTMESHSENDSIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer.
Keep rejecting zero-length and oversized advertising payloads, but validate advdatalen explicitly and require the command length to exactly match the flexible array size before queueing the request.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43017?
CVE-2026-43017 has been rated as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-43017?
Fixing CVE-2026-43017 involves updating the Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2026-43017?
CVE-2026-43017 affects the Bluetooth subsystem in the Linux kernel across various versions.
What types of attacks can exploit CVE-2026-43017?
CVE-2026-43017 can potentially be exploited to cause denial of service or unauthorized access by manipulating advertising payload lengths.
Is CVE-2026-43017 already patched?
Yes, CVE-2026-43017 has been resolved in recent Linux kernel updates.