CVE-2026-72335

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72335", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.920Z", "datePublished": "2026-08-15T05:55:43.847Z", "dateUpdated": "2026-10-16T18:55:18.546Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:55.650Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix adv monitor add failure cleanup\n\nhci_add_adv_monitor() publishes a new adv_monitor in\nhdev->adv_monitors_idr before the powered MSFT setup step. The MSFT\noffload add path can then fail either locally before the controller add\ncommand completes, or in the MSFT add callback. In the current queued\nmanagement add flow, hci_cmd_sync_work() still invokes\nmgmt_add_adv_patterns_monitor_complete() with the original pending command\nafter msft_add_monitor_pattern() returns.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMSFT add handling MGMT completion\n1. insert monitor and handle 1. receive sync error\n2. send MSFT add command 2. call add-monitor completion\n3. callback sees bad response 3. load cmd->user_data\n4. callback frees monitor 4. read monitor->handle\n\nLocal MSFT setup failures have the other half of the same ownership bug:\nthey return an error after the IDR insertion, but no later code removes the\nfailed monitor from the IDR.\n\nKeep ownership with the pending management command until its completion.\nFor normal management adds, the MSFT add callback now records successful\ncontroller state and returns errors to its caller. The management\ncompletion frees the monitor on non-success after copying the response\nhandle, while resume/reregister callback-error cleanup remains in the\nMSFT callback. The success path keeps the existing bookkeeping.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x19f/0x330\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n kasan_report+0xe0/0x110\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? 0xffffffffc00d00da\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]\n hci_cmd_sync_work+0x1c0/0x210 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n process_one_work+0x4fd/0xbc0\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nAllocated by task 471 on cpu 3 at 285.205389s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0xaa/0xb0\n add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n __sys_sendto+0x2bc/0x2d0\n __x64_sys_sendto+0x76/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 454 on cpu 2 at 285.217112s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x313/0x590\n msft_add_monitor_sync+0x54a/0x570 [bluetooth]\n hci_add_adv_monitor+0x133/0x180 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached by a local process sending MGMT_OP_ADD_ADV_PATTERNS_MONITOR(_RSSI) on a PF_BLUETOOTH HCI_CHANNEL_CONTROL socket via sendto(); remote Bluetooth peers cannot inject MGMT commands, matching prior CNA scoring for the same adv-monitor MGMT path.\nAC:L - On MSFT-capable controllers the attacker fully controls the add-monitor request and can repeatedly submit patterns/RSSI values that cause the MSFT offload add to fail, deterministically driving the callback-free-then-completion-dereference sequence without uncontrollable races.\nPR:L - The handler lacks HCI_MGMT_UNTRUSTED, so the socket must be trusted via CAP_NET_ADMIN; namespace-scoped capability checks allow an unprivileged local user to satisfy this through user namespaces, and session users can also reach it via BlueZ.\nUI:N - Exploitation requires only programmatic MGMT commands from the attacker process; no victim interaction such as pairing, accepting connections, or mounting resources is needed once the required local privileges are available.\nS:U - Impact is kernel slab corruption and Bluetooth MGMT state misuse within the same kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries into a separate security scope.\nC:H - This is a slab use-after-free of struct adv_monitor: mgmt_add_adv_patterns_monitor_complete reads monitor->handle after msft_le_monitor_advertisement_cb kfree()s it, enabling reclaimed-object reads and information disclosure under conservative kernel UAF guidance.\nI:H - Freed adv_monitor slabs can be reallocated with attacker-influenced data and abused through subsequent kernel dereferences and heap manipulation, providing a plausible path to arbitrary memory corruption and control-flow hijack beyond a simple crash.\nA:H - The bug was validated with KASAN slab-use-after-free in mgmt_add_adv_patterns_monitor_complete, and repeated failing MSFT add attempts can trigger kernel oops/panic from dereferencing freed monitor memory."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/mgmt.c", "net/bluetooth/msft.c"], "versions": [{"version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "b1a719b3c4359ef731646fb7c7844e53dddbda72", "status": "affected", "versionType": "git"}, {"version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "5aabbd01ac315a72bcdfd42985ede712c4744689", "status": "affected", "versionType": "git"}, {"version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "fb256d07395ebbc950f42e439d3896ec3a25c845", "status": "affected", "versionType": "git"}, {"version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "dfc8373893b1876bb367700eac9d776316dabd96", "status": "affected", "versionType": "git"}, {"version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "dbd935a9e056545721bc4e9ce518c775d787b21e", "status": "affected", "versionType": "git"}, {"version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "384a4b2fef9ffe5e270ee5558975c0504881c5fb", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/mgmt.c", "net/bluetooth/msft.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b1a719b3c4359ef731646fb7c7844e53dddbda72"}, {"url": "https://git.kernel.org/stable/c/5aabbd01ac315a72bcdfd42985ede712c4744689"}, {"url": "https://git.kernel.org/stable/c/fb256d07395ebbc950f42e439d3896ec3a25c845"}, {"url": "https://git.kernel.org/stable/c/dfc8373893b1876bb367700eac9d776316dabd96"}, {"url": "https://git.kernel.org/stable/c/dbd935a9e056545721bc4e9ce518c775d787b21e"}, {"url": "https://git.kernel.org/stable/c/384a4b2fef9ffe5e270ee5558975c0504881c5fb"}], "title": "Bluetooth: MGMT: Fix adv monitor add failure cleanup", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72335", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:47:13.463794Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:18.546Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72335", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T18:47:13.463794Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:47:14.147Z"}}], "cna": {"title": "Bluetooth: MGMT: Fix adv monitor add failure cleanup", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached by a local process sending MGMT_OP_ADD_ADV_PATTERNS_MONITOR(_RSSI) on a PF_BLUETOOTH HCI_CHANNEL_CONTROL socket via sendto(); remote Bluetooth peers cannot inject MGMT commands, matching prior CNA scoring for the same adv-monitor MGMT path.\nAC:L - On MSFT-capable controllers the attacker fully controls the add-monitor request and can repeatedly submit patterns/RSSI values that cause the MSFT offload add to fail, deterministically driving the callback-free-then-completion-dereference sequence without uncontrollable races.\nPR:L - The handler lacks HCI_MGMT_UNTRUSTED, so the socket must be trusted via CAP_NET_ADMIN; namespace-scoped capability checks allow an unprivileged local user to satisfy this through user namespaces, and session users can also reach it via BlueZ.\nUI:N - Exploitation requires only programmatic MGMT commands from the attacker process; no victim interaction such as pairing, accepting connections, or mounting resources is needed once the required local privileges are available.\nS:U - Impact is kernel slab corruption and Bluetooth MGMT state misuse within the same kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries into a separate security scope.\nC:H - This is a slab use-after-free of struct adv_monitor: mgmt_add_adv_patterns_monitor_complete reads monitor->handle after msft_le_monitor_advertisement_cb kfree()s it, enabling reclaimed-object reads and information disclosure under conservative kernel UAF guidance.\nI:H - Freed adv_monitor slabs can be reallocated with attacker-influenced data and abused through subsequent kernel dereferences and heap manipulation, providing a plausible path to arbitrary memory corruption and control-flow hijack beyond a simple crash.\nA:H - The bug was validated with KASAN slab-use-after-free in mgmt_add_adv_patterns_monitor_complete, and repeated failing MSFT add attempts can trigger kernel oops/panic from dereferencing freed monitor memory."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "b1a719b3c4359ef731646fb7c7844e53dddbda72", "versionType": "git"}, {"status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "5aabbd01ac315a72bcdfd42985ede712c4744689", "versionType": "git"}, {"status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "fb256d07395ebbc950f42e439d3896ec3a25c845", "versionType": "git"}, {"status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "dfc8373893b1876bb367700eac9d776316dabd96", "versionType": "git"}, {"status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "dbd935a9e056545721bc4e9ce518c775d787b21e", "versionType": "git"}, {"status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "lessThan": "384a4b2fef9ffe5e270ee5558975c0504881c5fb", "versionType": "git"}], "programFiles": ["net/bluetooth/mgmt.c", "net/bluetooth/msft.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/mgmt.c", "net/bluetooth/msft.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b1a719b3c4359ef731646fb7c7844e53dddbda72"}, {"url": "https://git.kernel.org/stable/c/5aabbd01ac315a72bcdfd42985ede712c4744689"}, {"url": "https://git.kernel.org/stable/c/fb256d07395ebbc950f42e439d3896ec3a25c845"}, {"url": "https://git.kernel.org/stable/c/dfc8373893b1876bb367700eac9d776316dabd96"}, {"url": "https://git.kernel.org/stable/c/dbd935a9e056545721bc4e9ce518c775d787b21e"}, {"url": "https://git.kernel.org/stable/c/384a4b2fef9ffe5e270ee5558975c0504881c5fb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix adv monitor add failure cleanup\n\nhci_add_adv_monitor() publishes a new adv_monitor in\nhdev->adv_monitors_idr before the powered MSFT setup step. The MSFT\noffload add path can then fail either locally before the controller add\ncommand completes, or in the MSFT add callback. In the current queued\nmanagement add flow, hci_cmd_sync_work() still invokes\nmgmt_add_adv_patterns_monitor_complete() with the original pending command\nafter msft_add_monitor_pattern() returns.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMSFT add handling MGMT completion\n1. insert monitor and handle 1. receive sync error\n2. send MSFT add command 2. call add-monitor completion\n3. callback sees bad response 3. load cmd->user_data\n4. callback frees monitor 4. read monitor->handle\n\nLocal MSFT setup failures have the other half of the same ownership bug:\nthey return an error after the IDR insertion, but no later code removes the\nfailed monitor from the IDR.\n\nKeep ownership with the pending management command until its completion.\nFor normal management adds, the MSFT add callback now records successful\ncontroller state and returns errors to its caller. The management\ncompletion frees the monitor on non-success after copying the response\nhandle, while resume/reregister callback-error cleanup remains in the\nMSFT callback. The success path keeps the existing bookkeeping.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x19f/0x330\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n kasan_report+0xe0/0x110\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? 0xffffffffc00d00da\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]\n hci_cmd_sync_work+0x1c0/0x210 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n process_one_work+0x4fd/0xbc0\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nAllocated by task 471 on cpu 3 at 285.205389s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0xaa/0xb0\n add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n __sys_sendto+0x2bc/0x2d0\n __x64_sys_sendto+0x76/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 454 on cpu 2 at 285.217112s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x313/0x590\n msft_add_monitor_sync+0x54a/0x570 [bluetooth]\n hci_add_adv_monitor+0x133/0x180 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:42:55.650Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72335", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:18.546Z", "dateReserved": "2026-08-09T03:40:39.920Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:55:43.847Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/mgmt.c", "net/bluetooth/msft.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b1a719b3c4359ef731646fb7c7844e53dddbda72", "status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "versionType": "git"}, {"lessThan": "5aabbd01ac315a72bcdfd42985ede712c4744689", "status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "versionType": "git"}, {"lessThan": "fb256d07395ebbc950f42e439d3896ec3a25c845", "status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "versionType": "git"}, {"lessThan": "dfc8373893b1876bb367700eac9d776316dabd96", "status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "versionType": "git"}, {"lessThan": "dbd935a9e056545721bc4e9ce518c775d787b21e", "status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "versionType": "git"}, {"lessThan": "384a4b2fef9ffe5e270ee5558975c0504881c5fb", "status": "affected", "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/mgmt.c", "net/bluetooth/msft.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix adv monitor add failure cleanup\n\nhci_add_adv_monitor() publishes a new adv_monitor in\nhdev->adv_monitors_idr before the powered MSFT setup step. The MSFT\noffload add path can then fail either locally before the controller add\ncommand completes, or in the MSFT add callback. In the current queued\nmanagement add flow, hci_cmd_sync_work() still invokes\nmgmt_add_adv_patterns_monitor_complete() with the original pending command\nafter msft_add_monitor_pattern() returns.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMSFT add handling MGMT completion\n1. insert monitor and handle 1. receive sync error\n2. send MSFT add command 2. call add-monitor completion\n3. callback sees bad response 3. load cmd->user_data\n4. callback frees monitor 4. read monitor->handle\n\nLocal MSFT setup failures have the other half of the same ownership bug:\nthey return an error after the IDR insertion, but no later code removes the\nfailed monitor from the IDR.\n\nKeep ownership with the pending management command until its completion.\nFor normal management adds, the MSFT add callback now records successful\ncontroller state and returns errors to its caller. The management\ncompletion frees the monitor on non-success after copying the response\nhandle, while resume/reregister callback-error cleanup remains in the\nMSFT callback. The success path keeps the existing bookkeeping.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x19f/0x330\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n kasan_report+0xe0/0x110\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? 0xffffffffc00d00da\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]\n hci_cmd_sync_work+0x1c0/0x210 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n process_one_work+0x4fd/0xbc0\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nAllocated by task 471 on cpu 3 at 285.205389s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0xaa/0xb0\n add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n __sys_sendto+0x2bc/0x2d0\n __x64_sys_sendto+0x76/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 454 on cpu 2 at 285.217112s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x313/0x590\n msft_add_monitor_sync+0x54a/0x570 [bluetooth]\n hci_add_adv_monitor+0x133/0x180 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30"}], "id": "CVE-2026-72335", "lastModified": "2026-10-16T19:17:23.623", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72335", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:47:13.463794Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:06.677", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/384a4b2fef9ffe5e270ee5558975c0504881c5fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5aabbd01ac315a72bcdfd42985ede712c4744689"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b1a719b3c4359ef731646fb7c7844e53dddbda72"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dbd935a9e056545721bc4e9ce518c775d787b21e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dfc8373893b1876bb367700eac9d776316dabd96"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb256d07395ebbc950f42e439d3896ec3a25c845"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Bluetooth: MGMT: Fix adv monitor add failure cleanup", "id": "2516629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516629"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. A use-after-free vulnerability exists in the advertisement monitor add failure cleanup process. This occurs because an advertisement monitor object is prematurely freed while a subsequent management routine attempts to access the freed memory. A local attacker could potentially exploit this flaw to cause a denial of service or system instability."], "name": "CVE-2026-72335", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72335\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72335\nhttps://lore.kernel.org/linux-cve-announce/2026081509-CVE-2026-72335-686c@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2a4dedf88ab2f807a7ca90947d686816b430f97,b1a719b3c4359ef731646fb7c7844e53dddbda72)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2a4dedf88ab2f807a7ca90947d686816b430f97,5aabbd01ac315a72bcdfd42985ede712c4744689)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2a4dedf88ab2f807a7ca90947d686816b430f97,fb256d07395ebbc950f42e439d3896ec3a25c845)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2a4dedf88ab2f807a7ca90947d686816b430f97,dfc8373893b1876bb367700eac9d776316dabd96)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2a4dedf88ab2f807a7ca90947d686816b430f97,dbd935a9e056545721bc4e9ce518c775d787b21e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a2a4dedf88ab2f807a7ca90947d686816b430f97,384a4b2fef9ffe5e270ee5558975c0504881c5fb)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T18:45:03.373510+00:00", "title": "Use-After-Free in Bluetooth Adv Monitor Add Path", "updated": "2026-08-22T08:45:03.181187+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}