In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
This fixes the condition checking so mgmt_pending_valid is executed
whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)
would kfree(cmd) without unlinking it from the list first, leaving a
dangling pointer. Any subsequent list traversal (e.g.,
mgmt_pending_foreach during __mgmt_power_off, or another
mgmt_pending_valid call) would dereference freed memory.
References
Configurations
Configuration 1 (hide)
|
History
28 Apr 2026, 14:59
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://git.kernel.org/stable/c/340666172cf747de58c283d2eef1f335f050538b - Patch | |
| References | () https://git.kernel.org/stable/c/3a89c33deffb3cb7877a7ea2e50734cd12b064f2 - Patch | |
| References | () https://git.kernel.org/stable/c/5f5fa4cd35f707344f65ce9e225b6528691dbbaa - Patch | |
| References | () https://git.kernel.org/stable/c/bafec9325d4de26b6c49db75b5d5172de652aae0 - Patch | |
| CPE | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.17:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
|
| First Time |
Linux
Linux linux Kernel |
|
| CWE | CWE-416 |
27 Apr 2026, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-04-28 14:59
NVD link : CVE-2026-31511
Mitre link : CVE-2026-31511
CVE.ORG link : CVE-2026-31511
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free