CVE-2026-43017: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-43017 is a buffer overflow vulnerability in the Linux kernel's Bluetooth MGMT subsystem, specifically in the mesh_send() function handling MGMT_OP_MESH_SEND commands. The flaw arises because the function validates total command length (20–50 bytes) but never verifies that the embedded adv_data_len field matches the actual bytes supplied in the flexible adv_data[] array, allowing a truncated command to drive the async mesh send path past the end of the queued command buffer. It affects Linux kernel versions 6.1.x before 6.1.168, 6.2.x–6.6.x before 6.6.134, 6.7.x–6.12.x before 6.12.81, 6.13.x–6.18.x before 6.18.22, 6.19.x before 6.19.12, and 7.0 release candidates. It was published on May 1, 2026, with patches available the same day. The CVSS v3.1 base score is 5.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-130 (Improper Handling of Length Parameter Inconsistency). The mesh_send() function in the Bluetooth MGMT layer uses MGMT_MESH_SEND_SIZE, which covers only the fixed header, to bound the total command length. However, it never cross-validates the embedded adv_data_len field against the actual number of bytes present in the flexible adv_data[] array. A local, low-privileged attacker can craft a MGMT_OP_MESH_SEND command where adv_data_len is set to a value larger than the actual data supplied, passing the 20–50 byte range check while causing the async mesh send path to read beyond the end of the allocated command buffer. The fix requires the command length to exactly equal MGMT_MESH_SEND_SIZE + adv_data_len before the request is queued (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation by a local, low-privileged user could result in kernel memory corruption through buffer over-read or over-write conditions, potentially leading to a kernel denial of service (system crash) or kernel information disclosure. There is no confidentiality or integrity impact identified in the CVSS scoring (availability impact is rated High), and the scope is unchanged, meaning exploitation is contained to the affected kernel component. Systems with Bluetooth mesh functionality enabled are most at risk (GitHub Advisory, Red Hat).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (GitHub Advisory). The vulnerability requires local access with low privileges and targets systems with Bluetooth mesh functionality enabled, limiting the attack surface. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Apply the available kernel patches, which are backported to the following stable versions: 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0. Upstream patch commits are available on kernel.org for each affected stable branch. If immediate patching is not feasible, consider disabling Bluetooth mesh functionality if it is not operationally required, and restrict local access to Bluetooth management interfaces. Monitor system logs for anomalous Bluetooth MGMT command activity as a compensating control (GitHub Advisory, Red Hat Bugzilla).