{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-31511", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-31511" ], "published": "2026-04-22T13:57:42Z", "summary": "Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete\n\nThis fixes the condition checking so mgmt_pending_valid is executed\nwhenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)\nwould kfree(cmd) without unlinking it from the list first, leaving a\ndangling pointer. Any subsequent list traversal (e.g.,\nmgmt_pending_foreach during __mgmt_power_off, or another\nmgmt_pending_valid call) would dereference freed memory.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.12.62-1+rpt1~bookworm", "1:6.12.75-1+rpt1~bookworm" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.62+rpt-rpi-2712", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v6", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v7", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v7l", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v6", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7l", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1~bookworm" } ] }, "database_specific": { "per_version": { "1:6.12.62-1+rpt1~bookworm": { "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c", "upstream_version": "6.12.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.80" }, "1:6.12.75-1+rpt1~bookworm": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.80" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.12.62-1+rpt1", "1:6.12.75-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.62+rpt-rpi-2712", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v6", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v7", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v6", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v7", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.62-1+rpt1": { "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c", "upstream_version": "6.12.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.80" }, "1:6.12.75-1+rpt1": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.80" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31511" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/2074dfffad76981ca451cb7fc98703d04ac562fe" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T13:16:28Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 7.8, "cvss_v3_severity": "High", "scenario": "AV:L - The vulnerable path is reached by a local process sending `MGMT_OP_ADD_ADV_PATTERNS_MONITOR` or `_RSSI` over a `PF_BLUETOOTH` HCI management/control socket. Remote Bluetooth peers do not issue MGMT commands into this path.\nAC:L - The bug occurs on normal non-canceled completion: the command is freed without being unlinked, and the attacker can trigger later list traversal with another MGMT command or device power/index removal. No uncontrollable race is required.\nPR:L - The affected handlers are not marked untrusted, so the socket must be trusted via `CAP_NET_ADMIN`. Because the checks use namespace-scoped capability checks and can be satisfied by an unprivileged local user through user namespaces in plausible deployments, this is Low rather than High.\nUI:N - After obtaining the required local privileges, the attacker can send the MGMT command and trigger the follow-up traversal directly. No victim action is required.\nS:U - The vulnerability corrupts kernel Bluetooth/MGMT state within the same kernel security authority. This is standard local kernel memory corruption, not a VM, IOMMU, or cross-authority boundary escape for CVSS scope.\nC:H - This is a use-after-free of `struct mgmt_pending_cmd` left on a kernel list, and freed slab contents can be reclaimed or read during later traversal. Under the required conservative kernel guidance, UAFs are scored as high confidentiality impact.\nI:H - The dangling list entry can lead to attacker-influenced use of freed kernel memory and list operations/callback dereferences, which is defensibly exploitable beyond a crash. Under the required conservative kernel guidance, UAF memory corruption is high integrity impact.\nA:H - Subsequent traversal of the freed pending command can dereference freed memory and cause a kernel oops/panic, as similar MGMT UAF fixes show. The attacker can trigger this repeatedly once the vulnerable state is created." } } }