What’s Vulnerable › Vulnerabilities

CVE-2026-31511: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-04-22 · updated 2026-10-19
• Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete This fixes the condition checking so mgmt_pending_valid is executed whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd) would kfree(cmd) without unlinking it from the list first, leaving a dangling pointer. Any subsequent list traversal (e.g., mgmt_pending_foreach during __mgmt_power_off, or another mgmt_pending_valid call) would dereference freed memory.

Affected products

• Linux kernel: from 6.12.59 before 6.12.80; from 6.16.10 before 6.17; from 6.17.1 before 6.18.21; from 6.19 before 6.19.11; 6.17, 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4, 7.0-rc5 (+2) — fixed in 6.12.80, 6.17, 6.18.21, 6.19.11

How to fix

Upgrade to a fixed version: Linux kernel 6.12.80, 6.17, 6.18.21, 6.19.11. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe
• https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b
• https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2
• https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa
• https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0

Get alerted when CVE-2026-31511 or the next vulnerability affects your stack