CVE-2026-43059
Vulnérabilité non évaluée dans Linux (Linux)
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced mgmt_pending_valid(), which not only validates the pending command but also unlinks it from the pending list if it is valid. This change in semantics requires updates to several completion handlers to avoid list corruption and memory safety issues. This patch addresses two left-over issues from the aforementioned rework: 1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove() is replaced with mgmt_pending_free() in the success path. Since mgmt_pending_valid() already unlinks the command at the beginning of the function, calling mgmt_pending_remove() leads to a double list_del() and subsequent list corruption/kernel panic. 2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error path is removed. Since the current command is already unlinked by mgmt_pending_valid(), this foreach loop would incorrectly target other pending mesh commands, potentially freeing them while they are still being processed concurrently (leading to UAFs). The redundant mgmt_cmd_status() is also simplified to use cmd->opcode directly.
Gravité et risque d'exploitation
CVE-2026-43059 obtient un score CVSS de 0.0/10, soit une gravité non évaluée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 6.6 % des CVE référencées.
Que faire ?
- Vérifiez si Linux (versions d71b98f253b079cbadc83266383f26fe7e9e103b, <=6.12.*, 6.12.78, <695b45b2262fcb5e71bed1175aad59c72f92aa78, 6.17, 0, 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a, 7.0, <6.12.78, 302a1f674c00dd5581ab8e493ef44767c5101aab, <=6.19.*, <b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77, 87a1f16f07c6c43771754075e08f45b41d237421, <=6.18.*, <17f89341cb4281d1da0e2fb0de5406ab7c4e25ef, <02023ff760cc104a5d86a82ef5b8dd89098ad78d, <6.17, 6.12.59, <6.7, <=*, 6.19.10, 6.6.140, 6.18.20, 6.16.10) est présent sur votre parc.
- Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
- À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
- Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.