CVE-2026-43059

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced mgmt_pending_valid(), which not only validates the pending command but also unlinks it from the pending list if it is valid. This change in semantics requires updates to several completion handlers to avoid list corruption and memory safety issues. This patch addresses two left-over issues from the aforementioned rework: 1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove() is replaced with mgmt_pending_free() in the success path. Since mgmt_pending_valid() already unlinks the command at the beginning of the function, calling mgmt_pending_remove() leads to a double list_del() and subsequent list corruption/kernel panic. 2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error path is removed. Since the current command is already unlinked by mgmt_pending_valid(), this foreach loop would incorrectly target other pending mesh commands, potentially freeing them while they are still being processed concurrently (leading to UAFs). The redundant mgmt_cmd_status() is also simplified to use cmd->opcode directly.

Overview

State: PUBLISHED
Assigner (CNA): Linux
CVSS severity: high
CVSS score: 7.8 / 10
CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Effective score: 7.8 / 10 HIGH source: CNA overview
MSRC score: 7.8 / 10 HIGH MS rating: Important
CWE(s): CWE-416
Reserved: 2026-05-01
Published: 2026-05-05 17:17 UTC
Last updated: 2026-05-17 17:21 UTC
Source: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/43xxx/CVE-2026-43059.json
Linked Threat: CVE-2026-43059 — CVE-2026-43059

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published: 2026-05-05 16:16:14 UTC
NVD last modified: 2026-05-06 13:08:07 UTC
EPSS score: 0.0002 (probability of exploitation in next 30 days)
EPSS percentile: 6.85% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID: EUVD-2026-27351
Assigner: Linux
Published: May 5, 2026, 3:17:25 PM
Updated: May 23, 2026, 4:06:09 PM
EUVD base score: 0.0 / 10
EUVD-reported EPSS: 0.0100
Vendors: Linux
Products: Linux (302a1f674c00dd5581ab8e493ef44767c5101aab <17f89341cb4281d1da0e2fb0de5406ab7c4e25ef)

Linux (6.17)

Linux (patch: 0)

Linux (patch: 6.12.78)

Linux (6.6.140 <6.7)

Linux (6.12.59 <6.12.78)

Linux (302a1f674c00dd5581ab8e493ef44767c5101aab <b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77)

Linux (patch: 6.19.10)

Linux (87a1f16f07c6c43771754075e08f45b41d237421)

Linux (6.16.10 <6.17)

Linux (302a1f674c00dd5581ab8e493ef44767c5101aab <02023ff760cc104a5d86a82ef5b8dd89098ad78d)

Linux (patch: 6.18.20)

Linux (d71b98f253b079cbadc83266383f26fe7e9e103b <695b45b2262fcb5e71bed1175aad59c72f92aa78)

Linux (patch: 7.0)

Linux (0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a)

ENISA description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced mgmt_pending_valid(), which not only validates the pending command but also unlinks it from the pending list if it is valid. This change in semantics requires updates to several completion handlers to avoid list corruption and memory safety issues. This patch addresses two left-over issues from the aforementioned rework: 1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove() is replaced with mgmt_pending_free() in the success path. Since mgmt_pending_valid() already unlinks the command at the beginning of the function, calling mgmt_pending_remove() leads to a double list_del() and subsequent list corruption/kernel panic. 2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error path is removed. Since the current command is already unlinked by mgmt_pending_valid(), this foreach loop would incorrectly target other pending mesh commands, potentially freeing them while they are still being processed concurrently (leading to UAFs). The redundant mgmt_cmd_status() is also simplified to use cmd->opcode directly.

EUVD references (4)

Microsoft Security Response Center MSRC

Microsoft's vendor-authoritative record from the Security Update Guide — its own CVSS score, impact, severity rating, exploit assessment, and KB-article fixes. Refreshed 2026-08-12 01:09 UTC (source: CVRF).

MS severity: Important
MS CVSS base score: 7.8 / 10 (temporal 7.8)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release: 2026-May

Affected products (2)

Vendor	Product	Versions	Platforms
Linux	Linux	`d71b98f253b079cbadc83266383f26fe7e9e103b` (affected), `302a1f674c00dd5581ab8e493ef44767c5101aab` (affected), `302a1f674c00dd5581ab8e493ef44767c5101aab` (affected), `302a1f674c00dd5581ab8e493ef44767c5101aab` (affected), `0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a` (affected), `87a1f16f07c6c43771754075e08f45b41d237421` (affected)	—
Linux	Linux	`6.17` (affected), `0` (unaffected), `6.12.78` (unaffected), `6.18.20` (unaffected), `6.19.10` (unaffected), `7.0` (unaffected)	—

Vendor references (4)

References embedded in the original CVE record by the assigning CNA.

MITRE references (4) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

Web references (4)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

MSRC update guide: CVE-2026-43059 msrc
https://www.first.org/epss/ tenable:www.first.org
https://nvd.nist.gov/vuln/detail/CVE-2026-43059 tenable:nvd.nist.gov
https://www.cve.org/CVERecord?id=CVE-2026-43059 tenable:www.cve.org

NVD-tagged references (4)

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

https://git.kernel.org/stable/c/02023ff760cc104a5d86a82ef5b8dd89098ad78d 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/695b45b2262fcb5e71bed1175aad59c72f92aa78 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remediations (18)

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

Microsoft and Adobe Patch Tuesday, February 2026 Security Update Review

web:blog.qualys.com

Microsoft's February 2026 Patch Tuesday focuses on closing security gaps that attackers could exploit, reinforcing the importance of timely patching in enterprise environments. Here's a quick…

2026-05-23 21:13 UTC
Patch Tuesday, May 2026 Edition - Krebs on Security

web:krebsonsecurity.com

Microsoft expects that exploitation is more likely. May's Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.

2026-05-23 21:13 UTC
Security Update Guide - Microsoft Security Response Center

web:msrc.microsoft.com

Security Update Guide - Microsoft Security Response Center

2026-05-23 21:13 UTC
February's Patch Tuesday release fixes 59 flaws ... - Computerworld

web:www.computerworld.com

Each month, the team at Readiness analyzes the latest Patch Tuesday updates from Microsoft and provides detailed, actionable testing guidance. The company's Patch Tuesday release for February ...

2026-05-23 21:13 UTC
CVE: Common Vulnerabilities and Exposures

web:www.cve.org

At cve .org, we provide the authoritative reference method for publicly known information-security vulnerabilities and exposures

2026-05-23 21:13 UTC
Emergency patch issued for Microsoft Office, 365 over hacking threat - MSN

web:www.msn.com

Microsoft suggests the threat is being used in phishing attacks against vulnerable systems since successful exploitation requires local access to the PC.

2026-05-23 21:13 UTC
Oracle Critical Patch Update Advisory - April 2026

web:www.oracle.com

This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

2026-05-23 21:13 UTC
Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic

web:www.techrepublic.com

Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

2026-05-23 21:13 UTC
Microsoft's April patch puts Windows domain controllers into reboot ...

web:www.tomshardware.com

Installing this month's Windows Server security update has knocked some enterprise domain controllers into continuous reboot cycles, Microsoft confirmed in a release health dashboard entry.

2026-05-23 21:13 UTC
Patch Tuesday May 2026: Security Updates & CVE Analysis

web:zecurit.com

Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

2026-05-23 21:13 UTC
Mitigate RedSun Zero-Day Without A Patch | Qualys

web:blog.qualys.com

Key Takeaways RedSun is a critical zero-day vulnerability in Microsoft Defender that allows low-privileged users to gain SYSTEM access No patch is currently available, leaving all Defender-enabled Windows systems potentially exposed Qualys VMDR detects affected assets instantly (QID 92382) TruRisk™ Eliminate enables immediate mitigation , removing exploitability without waiting for a fix ...

2026-06-03 07:49 UTC
Microsoft and Adobe Patch Tuesday, May 2026 Security Update Review

web:blog.qualys.com

May 2026's Patch Tuesday arrives with Microsoft addressing a fresh set of vulnerabilities across its ecosystem, reinforcing the ongoing need for timely patching in an increasingly threat-heavy…

2026-06-03 07:49 UTC
Microsoft Patch Tuesday May 2026 - 120 Vulnerabilities Fixed, Including ...

web:cybersecuritynews.com

Microsoft's May 2026 Patch Tuesday lands with a heavy enterprise focus, fixing 120 vulnerabilities across Windows, Office, Azure, developer tools, and Microsoft 365 apps, including 29 remote code execution (RCE) flaws rated Critical.

2026-06-03 07:49 UTC
Microsoft's May 2026 Patch Tuesday - Hive Pro

web:hivepro.com

Microsoft Patch Tuesday Overview and Vulnerability Distribution Microsoft's May 2026 Patch Tuesday delivers a comprehensive security update addressing 137 Microsoft vulnerabilities across the product ecosystem.

2026-06-03 07:49 UTC
Security Update Guide - Microsoft

web:msrc.microsoft.com

The Microsoft Security Response Center (MSRC) investigates all reports of security vulnerabilities affecting Microsoft products and services, and provides the information here as part of the ongoing effort to help you manage security risks and help keep your systems protected.

2026-06-03 07:49 UTC
Microsoft Technical Security Notifications

web:www.microsoft.com

Security Update Guide Notifications Microsoft's free Security Update Guide Notifications provide links to security-related software updates and notification of re-released security updates. These notifications are sent via email throughout the month as needed.

2026-06-03 07:49 UTC
Patch Tuesday May 2026 - PDQ

web:www.pdq.com

May 2026 Patch Tuesday is here, and PDQ is back with another recap. Will we see another month of increased CVE volume? Is AI to blame? Dive in to learn more.

2026-06-03 07:49 UTC
Patch Tuesday - May 2026 - Rapid7

web:www.rapid7.com

Microsoft is publishing 137 vulnerabilities on May 2026 Patch Tuesday, including critical RCE in Netlogon and the Windows DNS client.

2026-06-03 07:49 UTC

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.

Raw JSON

The full cvelistV5 record. Download as CVE-2026-43059.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "695b45b2262fcb5e71bed1175aad59c72f92aa78",
              "status": "affected",
              "version": "d71b98f253b079cbadc83266383f26fe7e9e103b",
              "versionType": "git"
            },
            {
              "lessThan": "b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "lessThan": "02023ff760cc104a5d86a82ef5b8dd89098ad78d",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "lessThan": "17f89341cb4281d1da0e2fb0de5406ab7c4e25ef",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "87a1f16f07c6c43771754075e08f45b41d237421",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "6.12.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.6.140",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix list corruption and UAF in command complete handlers\n\nCommit 302a1f674c00 (\"Bluetooth: MGMT: Fix possible UAFs\") introduced\nmgmt_pending_valid(), which not only validates the pending command but\nalso unlinks it from the pending list if it is valid. This change in\nsemantics requires updates to several completion handlers to avoid list\ncorruption and memory safety issues.\n\nThis patch addresses two left-over issues from the aforementioned rework:\n\n1. In mgmt_add_adv_patterns_monitor_complete(), mgmt_pending_remove()\nis replaced with mgmt_pending_free() in the success path. Since\nmgmt_pending_valid() already unlinks the command at the beginning of\nthe function, calling mgmt_pending_remove() leads to a double list_del()\nand subsequent list corruption/kernel panic.\n\n2. In set_mesh_complete(), the use of mgmt_pending_foreach() in the error\npath is removed. Since the current command is already unlinked by\nmgmt_pending_valid(), this foreach loop would incorrectly target other\npending mesh commands, potentially freeing them while they are still being\nprocessed concurrently (leading to UAFs). The redundant mgmt_cmd_status()\nis also simplified to use cmd->opcode directly."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-17T15:21:36.682Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/695b45b2262fcb5e71bed1175aad59c72f92aa78"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5c5e96f3b0a5003c3ff98ebb33e59afec51dd77"
        },
        {
          "url": "https://git.kernel.org/stable/c/02023ff760cc104a5d86a82ef5b8dd89098ad78d"
        },
        {
          "url": "https://git.kernel.org/stable/c/17f89341cb4281d1da0e2fb0de5406ab7c4e25ef"
        }
      ],
      "title": "Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43059",
    "datePublished": "2026-05-05T15:17:25.727Z",
    "dateReserved": "2026-05-01T14:12:55.981Z",
    "dateUpdated": "2026-05-17T15:21:36.682Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}