CVE-2026-72335

A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. A use-after-free vulnerability exists in the advertisement monitor add failure cleanup process. This occurs because an advertisement monitor object is prematurely freed while a subsequent management routine attempts to access the freed memory. A local attacker could potentially exploit this flaw to cause a denial of service or system instability.

This vulnerability is rated as Moderate impact because exploitation requires local access to interact with the Bluetooth management socket and results primarily in a denial of service through a kernel crash. The flaw resides within error-handling routines during Bluetooth advertisement monitor configuration, limiting the risk of arbitrary code execution. Furthermore, enterprise server and cloud environments running without Bluetooth adapters or with Bluetooth services disabled are not exposed to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.