---
id: CVE-2026-43017
title: 'Bluetooth: MGMT: validate mesh send advertising payload length'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: MGMT: validate mesh send advertising payload length

  mesh_send() currently bounds MGMT_OP_MESH_SEND by total command
  length, but it never verifies that the b…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <
    24fa32369cf15d8fc918bdfe94097b12e6acada0
  - >-
    Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <
    244b639e6a3a8e26241e201004a3a9f764476631
  - >-
    Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <
    0b706fb2294aff3adfd54653bda1b5e356ad4566
  - >-
    Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <
    edb5898cfa91afe7e8f83eda18d93034c953d632
  - >-
    Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <
    562ed1954f0c1bff3422b7b752bd3dacf185edbf
  - >-
    Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 <
    bda93eec78cdbfe5cda00785cefebd443e56b88b
  - Linux 6.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:25:56.534475Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:26.286Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43017'
references:
  - url: 'https://git.kernel.org/stable/c/24fa32369cf15d8fc918bdfe94097b12e6acada0'
  - url: 'https://git.kernel.org/stable/c/244b639e6a3a8e26241e201004a3a9f764476631'
  - url: 'https://git.kernel.org/stable/c/0b706fb2294aff3adfd54653bda1b5e356ad4566'
  - url: 'https://git.kernel.org/stable/c/edb5898cfa91afe7e8f83eda18d93034c953d632'
  - url: 'https://git.kernel.org/stable/c/562ed1954f0c1bff3422b7b752bd3dacf185edbf'
  - url: 'https://git.kernel.org/stable/c/bda93eec78cdbfe5cda00785cefebd443e56b88b'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.02015
ingestedAt: '2026-11-06T15:54:04.036Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate mesh send advertising payload length

mesh_send() currently bounds MGMT_OP_MESH_SEND by total command
length, but it never verifies that the bytes supplied for the
flexible adv_data[] array actually match the embedded adv_data_len
field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a
truncated command can still pass the existing 20..50 byte range
check and later drive the async mesh send path past the end of the
queued command buffer.

Keep rejecting zero-length and oversized advertising payloads, but
validate adv_data_len explicitly and require the command length to
exactly match the flexible array size before queueing the request.

## Affected

- `Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 24fa32369cf15d8fc918bdfe94097b12e6acada0`
- `Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 244b639e6a3a8e26241e201004a3a9f764476631`
- `Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 0b706fb2294aff3adfd54653bda1b5e356ad4566`
- `Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 < edb5898cfa91afe7e8f83eda18d93034c953d632`
- `Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 < 562ed1954f0c1bff3422b7b752bd3dacf185edbf`
- `Linux >= b338d91703fae6f6afd67f3f75caa3b8f36ddef3 < bda93eec78cdbfe5cda00785cefebd443e56b88b`
- `Linux 6.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.