{"id":"CVE-2026-72335","revision":null,"records":[{"revision":"a4e17829b0704442a63071c7089dc1ba","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-72335","aliases":[],"title":"Bluetooth: MGMT: Fix adv monitor add failure cleanup","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix adv monitor add failure cleanup\n\nhci_add_adv_monitor() publishes a new adv_monitor in\nhdev->adv_monitors_idr before the powered MSFT setup step. The MSFT\noffload add path can then fail either locally before the controller add\ncommand completes, or in the MSFT add callback. In the current queued\nmanagement add flow, hci_cmd_sync_work() still invokes\nmgmt_add_adv_patterns_monitor_complete() with the original pending command\nafter msft_add_monitor_pattern() returns.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMSFT add handling                  MGMT completion\n1. insert monitor and handle       1. receive sync error\n2. send MSFT add command           2. call add-monitor completion\n3. callback sees bad response      3. load cmd->user_data\n4. callback frees monitor          4. read monitor->handle\n\nLocal MSFT setup failures have the other half of the same ownership bug:\nthey return an error after the IDR insertion, but no later code removes the\nfailed monitor from the IDR.\n\nKeep ownership with the pending management command until its completion.\nFor normal management adds, the MSFT add callback now records successful\ncontroller state and returns errors to its caller. The management\ncompletion frees the monitor on non-success after copying the response\nhandle, while resume/reregister callback-error cleanup remains in the\nMSFT callback. The success path keeps the existing bookkeeping.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n\nCall Trace:\n <TASK>\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x19f/0x330\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n kasan_report+0xe0/0x110\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? 0xffffffffc00d00da\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]\n hci_cmd_sync_work+0x1c0/0x210 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n process_one_work+0x4fd/0xbc0\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nAllocated by task 471 on cpu 3 at 285.205389s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0xaa/0xb0\n add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n __sys_sendto+0x2bc/0x2d0\n __x64_sys_sendto+0x76/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 454 on cpu 2 at 285.217112s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x313/0x590\n msft_add_monitor_sync+0x54a/0x570 [bluetooth]\n hci_add_adv_monitor+0x133/0x180 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30","state":0,"publishedAt":"2026-08-15T05:55:43.847+00:00","modifiedAt":"2026-10-16T18:55:18.546+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/mgmt.c\",\n                        \"net/bluetooth/msft.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\n                            \"lessThan\": \"b1a719b3c4359ef731646fb7c7844e53dddbda72\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\n                            \"lessThan\": \"5aabbd01ac315a72bcdfd42985ede712c4744689\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\n                            \"lessThan\": \"fb256d07395ebbc950f42e439d3896ec3a25c845\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\n                            \"lessThan\": \"dfc8373893b1876bb367700eac9d776316dabd96\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\n                            \"lessThan\": \"dbd935a9e056545721bc4e9ce518c775d787b21e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\n                            \"lessThan\": \"384a4b2fef9ffe5e270ee5558975c0504881c5fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/mgmt.c\",\n                        \"net/bluetooth/msft.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.178\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.145\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.97\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.40\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.5\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b1a719b3c4359ef731646fb7c7844e53dddbda72","https://git.kernel.org/stable/c/5aabbd01ac315a72bcdfd42985ede712c4744689","https://git.kernel.org/stable/c/fb256d07395ebbc950f42e439d3896ec3a25c845","https://git.kernel.org/stable/c/dfc8373893b1876bb367700eac9d776316dabd96","https://git.kernel.org/stable/c/dbd935a9e056545721bc4e9ce518c775d787b21e","https://git.kernel.org/stable/c/384a4b2fef9ffe5e270ee5558975c0504881c5fb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-72335","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-72335","identifiers":["CVE-2026-72335"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T09:04:02.9162191+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T09:04:02.9162191+00:00","lastSuccessAt":"2026-11-09T09:04:03.0760313+00:00","error":null,"lastVerifiedAt":"2026-11-09T09:04:03.0760345+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-0ea295a9c399a04b3ab57ccec2161d0d1cc039ee9ab5c4d8b6299048bd56b277","complete":true,"records":421333,"lastAttemptAt":"2026-11-09T09:02:14.7013141+00:00","lastSuccessAt":"2026-11-09T09:02:14.6291653+00:00","error":null,"lastVerifiedAt":"2026-11-09T09:02:14.7013141+00:00","snapshotPublishedAt":"2026-11-09T08:31:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f975b42a7c2d46f6899c3d764d777217","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T09:16:12.2541949+00:00","lastSuccessAt":"2026-11-09T09:16:12.249+00:00","error":"7 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T09:16:12.249+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13699,"expectedIdentifiers":13706,"failedIdentifiers":7},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T09:04:02.9162191+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T09:04:02.9162191+00:00","lastSuccessAt":"2026-11-09T09:04:03.197028+00:00","error":null,"lastVerifiedAt":"2026-11-09T09:04:03.1970284+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-156d67f0b09643159ff4bd684ee896db","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T09:04:03.6692263+00:00","lastSuccessAt":"2026-11-09T07:04:26.209+00:00","error":null,"lastVerifiedAt":"2026-11-09T07:04:26.209+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T09:04:02.7750454+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T09:04:02.7750454+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T09:02:14.7586225+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T09:02:14.7586225+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T09:04:02.8843128+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T09:04:02.8843128+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-d0592215f99679f1cc533698c7c7cf50c306057d38021110cecb15015dc78137","complete":true,"records":231297,"lastAttemptAt":"2026-11-09T09:04:02.4970329+00:00","lastSuccessAt":"2026-11-09T09:04:00.7848047+00:00","error":null,"lastVerifiedAt":"2026-11-09T09:04:02.4970329+00:00","snapshotPublishedAt":"2026-11-09T08:33:22+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}