CVE-2025-40213

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array.

Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove.

Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds.

As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.

This vulnerability presents no security risk to Red Hat Enterprise Linux because the affected Bluetooth Mesh management routines are not present in Red Hat supported kernels. The upstream flaw involves improper memory bounds handling and list tracking within the kernel Bluetooth subsystem, which could allow a local attacker to cause a denial of service. Because the commits introducing this functionality were never backported to Red Hat Enterprise Linux, enterprise environments are not impacted.