CVE-2026-43017

A flaw was found in the Bluetooth subsystem of the Linux kernel. A remote attacker could exploit this by sending a specially crafted Bluetooth Mesh advertising payload. The system fails to properly validate the length of the advertising data against the provided payload, leading to an out-of-bounds write. This memory corruption could result in a denial of service.

Bluetooth MGMT mesh advertising send must validate payload length before parsing. Red Hat recommends kernel updates; unload bluetooth where unused.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the bluetooth module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.