Executive Summary

This vulnerability exists in the Linux kernel's Bluetooth mesh management functionality. Specifically, the mesh_send() function does not properly verify that the length of the advertising data (adv_data) matches the length specified in the adv_data_len field. Although the total command length is checked, the flexible adv_data array length is not validated, allowing a truncated command to bypass length checks. This can cause the asynchronous mesh send process to read beyond the end of the command buffer, potentially leading to unexpected behavior.

Useful 0 Not Useful 0

Impact Analysis

Because the vulnerability allows the asynchronous mesh send path to read beyond the end of the queued command buffer, it could lead to memory corruption or other unintended behavior within the Bluetooth mesh functionality of the Linux kernel. This might be exploited to cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or disrupt Bluetooth communications.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that the Linux kernel is updated to a version where the Bluetooth MGMT mesh send advertising payload length validation is fixed.

Specifically, the fix involves validating the adv_data_len explicitly and requiring the command length to exactly match the flexible array size before queueing the request, preventing truncated or oversized advertising payloads from being processed.

Useful 0 Not Useful 0