CVE-2026-31511 PUBLISHED

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

Assigner: Linux
Reserved: 09.03.2026 Published: 22.04.2026 Updated: 22.04.2026

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from d71b98f253b079cbadc83266383f26fe7e9e103b to 340666172cf747de58c283d2eef1f335f050538b (excl.)
  • affected from 302a1f674c00dd5581ab8e493ef44767c5101aab to bafec9325d4de26b6c49db75b5d5172de652aae0 (excl.)
  • affected from 302a1f674c00dd5581ab8e493ef44767c5101aab to 3a89c33deffb3cb7877a7ea2e50734cd12b064f2 (excl.)
  • affected from 302a1f674c00dd5581ab8e493ef44767c5101aab to 5f5fa4cd35f707344f65ce9e225b6528691dbbaa (excl.)
  • Version 87a1f16f07c6c43771754075e08f45b41d237421 is affected
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.17 is affected
  • unaffected from 0 to 6.17 (excl.)
  • unaffected from 6.12.80 to 6.12.* (incl.)
  • unaffected from 6.18.21 to 6.18.* (incl.)
  • unaffected from 6.19.11 to 6.19.* (incl.)
  • unaffected from 7.0 to * (incl.)

References