CVE-2026-31511 (GCVE-0-2026-31511)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-08-05 12:23
VLAI
Title
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a , < 2074dfffad76981ca451cb7fc98703d04ac562fe (git)
Affected: d71b98f253b079cbadc83266383f26fe7e9e103b , < 340666172cf747de58c283d2eef1f335f050538b (git)
Affected: 302a1f674c00dd5581ab8e493ef44767c5101aab , < bafec9325d4de26b6c49db75b5d5172de652aae0 (git)
Affected: 302a1f674c00dd5581ab8e493ef44767c5101aab , < 3a89c33deffb3cb7877a7ea2e50734cd12b064f2 (git)
Affected: 302a1f674c00dd5581ab8e493ef44767c5101aab , < 5f5fa4cd35f707344f65ce9e225b6528691dbbaa (git)
Affected: 87a1f16f07c6c43771754075e08f45b41d237421 (git)
Affected: 6.12.59 , < 6.12.80 (semver)
Affected: 6.16.10 , < 6.17 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.17
Unaffected: 0 , < 6.17 (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "2074dfffad76981ca451cb7fc98703d04ac562fe",
              "status": "affected",
              "version": "0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a",
              "versionType": "git"
            },
            {
              "lessThan": "340666172cf747de58c283d2eef1f335f050538b",
              "status": "affected",
              "version": "d71b98f253b079cbadc83266383f26fe7e9e103b",
              "versionType": "git"
            },
            {
              "lessThan": "bafec9325d4de26b6c49db75b5d5172de652aae0",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "lessThan": "3a89c33deffb3cb7877a7ea2e50734cd12b064f2",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "lessThan": "5f5fa4cd35f707344f65ce9e225b6528691dbbaa",
              "status": "affected",
              "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "87a1f16f07c6c43771754075e08f45b41d237421",
              "versionType": "git"
            },
            {
              "lessThan": "6.12.80",
              "status": "affected",
              "version": "6.12.59",
              "versionType": "semver"
            },
            {
              "lessThan": "6.17",
              "status": "affected",
              "version": "6.16.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.17"
            },
            {
              "lessThan": "6.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "6.12.59",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.16.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by a local process sending `MGMT_OP_ADD_ADV_PATTERNS_MONITOR` or `_RSSI` over a `PF_BLUETOOTH` HCI management/control socket. Remote Bluetooth peers do not issue MGMT commands into this path.\nAC:L - The bug occurs on normal non-canceled completion: the command is freed without being unlinked, and the attacker can trigger later list traversal with another MGMT command or device power/index removal. No uncontrollable race is required.\nPR:L - The affected handlers are not marked untrusted, so the socket must be trusted via `CAP_NET_ADMIN`. Because the checks use namespace-scoped capability checks and can be satisfied by an unprivileged local user through user namespaces in plausible deployments, this is Low rather than High.\nUI:N - After obtaining the required local privileges, the attacker can send the MGMT command and trigger the follow-up traversal directly. No victim action is required.\nS:U - The vulnerability corrupts kernel Bluetooth/MGMT state within the same kernel security authority. This is standard local kernel memory corruption, not a VM, IOMMU, or cross-authority boundary escape for CVSS scope.\nC:H - This is a use-after-free of `struct mgmt_pending_cmd` left on a kernel list, and freed slab contents can be reclaimed or read during later traversal. Under the required conservative kernel guidance, UAFs are scored as high confidentiality impact.\nI:H - The dangling list entry can lead to attacker-influenced use of freed kernel memory and list operations/callback dereferences, which is defensibly exploitable beyond a crash. Under the required conservative kernel guidance, UAF memory corruption is high integrity impact.\nA:H - Subsequent traversal of the freed pending command can dereference freed memory and cause a kernel oops/panic, as similar MGMT UAF fixes show. The attacker can trigger this repeatedly once the vulnerable state is created."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:11.297Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe"
        },
        {
          "url": "https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b"
        },
        {
          "url": "https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa"
        }
      ],
      "title": "Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31511",
    "datePublished": "2026-04-22T13:54:29.420Z",
    "dateReserved": "2026-03-09T15:48:24.106Z",
    "dateUpdated": "2026-08-05T12:23:11.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31511",
      "date": "2026-09-26",
      "epss": "0.00175",
      "percentile": "0.06271"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/mgmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "2074dfffad76981ca451cb7fc98703d04ac562fe",
                    "status": "affected",
                    "version": "0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "340666172cf747de58c283d2eef1f335f050538b",
                    "status": "affected",
                    "version": "d71b98f253b079cbadc83266383f26fe7e9e103b",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bafec9325d4de26b6c49db75b5d5172de652aae0",
                    "status": "affected",
                    "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3a89c33deffb3cb7877a7ea2e50734cd12b064f2",
                    "status": "affected",
                    "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5f5fa4cd35f707344f65ce9e225b6528691dbbaa",
                    "status": "affected",
                    "version": "302a1f674c00dd5581ab8e493ef44767c5101aab",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "87a1f16f07c6c43771754075e08f45b41d237421",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.12.80",
                    "status": "affected",
                    "version": "6.12.59",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "affected",
                    "version": "6.16.10",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/bluetooth/mgmt.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.17"
                  },
                  {
                    "lessThan": "6.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.80",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.21",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2E3E9EB4-7DEE-45DF-B63A-FE5F72A20A3F",
                    "versionEndExcluding": "6.12.80",
                    "versionStartIncluding": "6.12.59",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1C91278E-7FC3-4EFB-AE2C-E82D42F4D3AA",
                    "versionEndExcluding": "6.17",
                    "versionStartIncluding": "6.16.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "44CB3599-9974-4F35-B3CC-580CAC6FA38B",
                    "versionEndExcluding": "6.18.21",
                    "versionStartIncluding": "6.17.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7",
                    "versionEndExcluding": "6.19.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:*",
                    "matchCriteriaId": "7CC8B11D-82DC-4958-8DC7-BF5CC829A5E9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*",
                    "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory."
          }
        ],
        "id": "CVE-2026-31511",
        "lastModified": "2026-06-17T10:33:53.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-22T14:16:50.343",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-02T17:14:17+00:00",
      "cve": "CVE-2026-31511",
      "id": "CVE-2026-31511",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31511.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T01:29:26Z",
      "cve": "CVE-2026-31511",
      "id": "CVE-2026-31511",
      "initial_release_date": "2026-04-23T01:25:09Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "489",
      "product_status:known_not_affected": "159",
      "product_status:recommended": "265",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31511",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31511.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.