Skip to content
Heist/ feed
High

Bluetooth: MGMT: Fix adv monitor add failure cleanup

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci_add_adv_monitor() publishes a new adv_monitor in hdev->adv_monitors_idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the controller add command completes, or in the MSFT add callback. In the current queued management add flow, hci_cmd_sync_work() still invokes mgmt_add_adv_patterns_monitor_complete() with the original pending command after msft_add_monitor_pattern() returns. The buggy scenario involves two paths, with each column showing the order within that path: MSFT add handling MGMT completion 1. insert monitor and handle 1. receive sync error 2. send MSFT add command 2. call add-monitor completion 3. callback sees bad response 3. load cmd->user_data 4. callback frees monitor 4. read monitor->handle Local MSFT setup failures have the other half of the same ownership bug: they return an error after the IDR insertion, but no later code removes the failed monitor from the IDR. Keep ownership with the pending management command until its completion. For normal management adds, the MSFT add callback now records successful controller state and returns errors to its caller. The management completion frees the monitor on non-success after copying the response handle, while resume/reregister callback-error cleanup remains in the MSFT callback. The success path keeps the existing bookkeeping. Validation re

Announced Source revision 1
Original source ↗

CVE-2026-72335

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-72335

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
        "lessThan": "b1a719b3c4359ef731646fb7c7844e53dddbda72",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
        "lessThan": "5aabbd01ac315a72bcdfd42985ede712c4744689",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
        "lessThan": "fb256d07395ebbc950f42e439d3896ec3a25c845",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
        "lessThan": "dfc8373893b1876bb367700eac9d776316dabd96",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
        "lessThan": "dbd935a9e056545721bc4e9ce518c775d787b21e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
        "lessThan": "384a4b2fef9ffe5e270ee5558975c0504881c5fb",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/bluetooth/mgmt.c",
      "net/bluetooth/msft.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "5.12"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "5.12",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "6.1.178",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.145",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.97",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.40",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.5",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/bluetooth/mgmt.c",
      "net/bluetooth/msft.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-72335

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#33026 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement