CVE-2026-43017

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: MGMT: validate mesh send advertising payload length<br /> <br /> mesh_send() currently bounds MGMT_OP_MESH_SEND by total command<br /> length, but it never verifies that the bytes supplied for the<br /> flexible adv_data[] array actually match the embedded adv_data_len<br /> field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a<br /> truncated command can still pass the existing 20..50 byte range<br /> check and later drive the async mesh send path past the end of the<br /> queued command buffer.<br /> <br /> Keep rejecting zero-length and oversized advertising payloads, but<br /> validate adv_data_len explicitly and require the command length to<br /> exactly match the flexible array size before queueing the request.