CVE-2026-43017

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate mesh send advertising payload length

mesh_send() currently bounds MGMT_OP_MESH_SEND by total command

length, but it never verifies that the bytes supplied for the

flexible adv_data[] array actually match the embedded adv_data_len

field. MGMT_MESH_SEND_SIZE only covers the fixed header, so a

truncated command can still pass the existing 20..50 byte range

check and later drive the async mesh send path past the end of the

queued command buffer.

Keep rejecting zero-length and oversized advertising payloads, but

validate adv_data_len explicitly and require the command length to

exactly match the flexible array size before queueing the request.