---
id: CVE-2025-40213
title: 'Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

  There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to
  memcpy from badly declared on-stac…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a <
    31d6c9216aa1be18ba317239738f73b0b0c7b691
  - >-
    Linux >= d71b98f253b079cbadc83266383f26fe7e9e103b <
    5c19daa93d9af29f1f46251b47e1ea66bcc8d679
  - >-
    Linux >= 302a1f674c00dd5581ab8e493ef44767c5101aab <
    1c9aca1787e8395a2c59fef20e914467958969c5
  - >-
    Linux >= 302a1f674c00dd5581ab8e493ef44767c5101aab <
    e8785404de06a69d89dcdd1e9a0b6ea42dc6d327
  - Linux 87a1f16f07c6c43771754075e08f45b41d237421
  - Linux >= 6.6.140 < 6.6.160
  - Linux >= 6.16.10 < 6.17
  - Linux 6.17
published: '2025-11-24'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:37:53.837Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-40213'
references:
  - url: 'https://git.kernel.org/stable/c/31d6c9216aa1be18ba317239738f73b0b0c7b691'
  - url: 'https://git.kernel.org/stable/c/5c19daa93d9af29f1f46251b47e1ea66bcc8d679'
  - url: 'https://git.kernel.org/stable/c/1c9aca1787e8395a2c59fef20e914467958969c5'
  - url: 'https://git.kernel.org/stable/c/e8785404de06a69d89dcdd1e9a0b6ea42dc6d327'
tags:
  - cve.org
epss: 0.00193
epssPercentile: 0.08947
ingestedAt: '2026-10-21T12:48:53.681Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to
memcpy from badly declared on-stack flexible array.

Another crash is in set_mesh_complete() due to double list_del via
mgmt_pending_valid + mgmt_pending_remove.

Use DEFINE_FLEX to declare the flexible array right, and don't memcpy
outside bounds.

As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free,
and also report status on error.

## Affected

- `Linux >= 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a < 31d6c9216aa1be18ba317239738f73b0b0c7b691`
- `Linux >= d71b98f253b079cbadc83266383f26fe7e9e103b < 5c19daa93d9af29f1f46251b47e1ea66bcc8d679`
- `Linux >= 302a1f674c00dd5581ab8e493ef44767c5101aab < 1c9aca1787e8395a2c59fef20e914467958969c5`
- `Linux >= 302a1f674c00dd5581ab8e493ef44767c5101aab < e8785404de06a69d89dcdd1e9a0b6ea42dc6d327`
- `Linux 87a1f16f07c6c43771754075e08f45b41d237421`
- `Linux >= 6.6.140 < 6.6.160`
- `Linux >= 6.16.10 < 6.17`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.