CVE-2025-40213: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-24 · updated 2026-10-21

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array. Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove. Use DEFINE_FLEX to declare the flexible array right, and don't memcpy outside bounds. As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.

Affected products

Linux kernel: from 6.6.140 before 6.6.160; from 6.16.10 before 6.17; 6.17 — fixed in 6.17, 6.18, 6.6.160

How to fix

Upgrade to a fixed version: Linux kernel 6.17, 6.18, 6.6.160. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-40213 or the next vulnerability affects your stack