CVE-2026-43017 Bluetooth: MGMT: validate mesh send advertising payload length
A missing length validation in the Linux kernel Bluetooth mesh send handler allows out-of-bounds memory access, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43017?
CVE-2026-43017 is a medium-severity memory corruption vulnerability in Linux kernel, published on 1 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate mesh send advertising payload length
mesh_send() currently bounds MGMT_OP_MESH_SEND by total command length, but it never verifies that the bytes supplied for the flexible adv_data[] array actually match the embedded adv_data_len field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a truncated command can still pass the existing 20..50 byte range check and later drive the async mesh send path past the end of the queued command buffer.
Keep rejecting zero-length and oversized advertising payloads, but validate adv_data_len explicitly and require the command length to exactly match the flexible array size before queueing the request.
Which versions are affected by CVE-2026-43017?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43017?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43017 being exploited?
There is no known exploitation of CVE-2026-43017 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43017, DEBIAN-CVE-2026-43017, GHSA-cgx3-p97x-fhh8, ROOT-OS-UBUNTU-2404-CVE-2026-43017, UBUNTU-CVE-2026-43017.