Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.80, 6.17, 6.18.21, 6.19.11
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 0b60eb04b8524e1b4b3f07fea0d16fda9a677d9a · fixed in 2074dfffad76981ca451cb7fc98703d04ac562fe; From d71b98f253b079cbadc83266383f26fe7e9e103b · fixed in 340666172cf747de58c283d2eef1f335f050538b; From 302a1f674c00dd5581ab8e493ef44767c5101aab · fixed in bafec9325d4de26b6c49db75b5d5172de652aae0; From 302a1f674c00dd5581ab8e493ef44767c5101aab · fixed in 3a89c33deffb3cb7877a7ea2e50734cd12b064f2; From 302a1f674c00dd5581ab8e493ef44767c5101aab · fixed in 5f5fa4cd35f707344f65ce9e225b6528691dbbaa; From 6.12.59 · fixed in 6.12.80; From 6.16.10 · fixed in 6.17
- Linux Linux
6.17
- KernelLinux
fixed in 6.12.80; From 6.13.0 · fixed in 6.18.21; From 6.17.0 · fixed in 6.19.11