GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72335 (GCVE-0-2026-72335)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:55 – Updated: 2026-08-17 05:42
VLAI
Title
Bluetooth: MGMT: Fix adv monitor add failure cleanup
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix adv monitor add failure cleanup hci_add_adv_monitor() publishes a new adv_monitor in hdev->adv_monitors_idr before the powered MSFT setup step. The MSFT offload add path can then fail either locally before the controller add command completes, or in the MSFT add callback. In the current queued management add flow, hci_cmd_sync_work() still invokes mgmt_add_adv_patterns_monitor_complete() with the original pending command after msft_add_monitor_pattern() returns. The buggy scenario involves two paths, with each column showing the order within that path: MSFT add handling MGMT completion 1. insert monitor and handle 1. receive sync error 2. send MSFT add command 2. call add-monitor completion 3. callback sees bad response 3. load cmd->user_data 4. callback frees monitor 4. read monitor->handle Local MSFT setup failures have the other half of the same ownership bug: they return an error after the IDR insertion, but no later code removes the failed monitor from the IDR. Keep ownership with the pending management command until its completion. For normal management adds, the MSFT add callback now records successful controller state and returns errors to its caller. The management completion frees the monitor on non-success after copying the response handle, while resume/reregister callback-error cleanup remains in the MSFT callback. The success path keeps the existing bookkeeping. Validation reproduced this kernel report: BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth] Call Trace: <TASK> dump_stack_lvl+0x66/0xa0 print_report+0xce/0x5f0 ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth] ? srso_alias_return_thunk+0x5/0xfbef5 ? __virt_addr_valid+0x19f/0x330 ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth] kasan_report+0xe0/0x110 ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth] mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth] ? srso_alias_return_thunk+0x5/0xfbef5 ? 0xffffffffc00d00da ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth] ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth] ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth] hci_cmd_sync_work+0x1c0/0x210 [bluetooth] ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth] process_one_work+0x4fd/0xbc0 ? __pfx_process_one_work+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? srso_alias_return_thunk+0x5/0xfbef5 ? __list_add_valid_or_report+0x37/0xf0 ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth] ? srso_alias_return_thunk+0x5/0xfbef5 worker_thread+0x2d8/0x570 ? __pfx_worker_thread+0x10/0x10 kthread+0x1ad/0x1f0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x3c9/0x540 ? __pfx_ret_from_fork+0x10/0x10 ? srso_alias_return_thunk+0x5/0xfbef5 ? __switch_to+0x2e9/0x730 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 471 on cpu 3 at 285.205389s: kasan_save_stack+0x33/0x60 kasan_save_track+0x17/0x60 __kasan_kmalloc+0xaa/0xb0 add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth] hci_sock_sendmsg+0x96b/0xf80 [bluetooth] __sys_sendto+0x2bc/0x2d0 __x64_sys_sendto+0x76/0x90 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 454 on cpu 2 at 285.217112s: kasan_save_stack+0x33/0x60 kasan_save_track+0x17/0x60 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x5f/0x80 kfree+0x313/0x590 msft_add_monitor_sync+0x54a/0x570 [bluetooth] hci_add_adv_monitor+0x133/0x180 [bluetooth] hci_cmd_sync_work+0x187/0x210 [bluetooth] process_one_work+0x4fd/0xbc0 worker_thread+0x2d8/0x570 kthread+0x1ad/0x1f0 ret_from_fork+0x3c9/0x540 ret_from_fork_asm+0x1a/0x30
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a2a4dedf88ab2f807a7ca90947d686816b430f97 , < b1a719b3c4359ef731646fb7c7844e53dddbda72 (git)
Affected: a2a4dedf88ab2f807a7ca90947d686816b430f97 , < 5aabbd01ac315a72bcdfd42985ede712c4744689 (git)
Affected: a2a4dedf88ab2f807a7ca90947d686816b430f97 , < fb256d07395ebbc950f42e439d3896ec3a25c845 (git)
Affected: a2a4dedf88ab2f807a7ca90947d686816b430f97 , < dfc8373893b1876bb367700eac9d776316dabd96 (git)
Affected: a2a4dedf88ab2f807a7ca90947d686816b430f97 , < dbd935a9e056545721bc4e9ce518c775d787b21e (git)
Affected: a2a4dedf88ab2f807a7ca90947d686816b430f97 , < 384a4b2fef9ffe5e270ee5558975c0504881c5fb (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c",
            "net/bluetooth/msft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b1a719b3c4359ef731646fb7c7844e53dddbda72",
              "status": "affected",
              "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
              "versionType": "git"
            },
            {
              "lessThan": "5aabbd01ac315a72bcdfd42985ede712c4744689",
              "status": "affected",
              "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
              "versionType": "git"
            },
            {
              "lessThan": "fb256d07395ebbc950f42e439d3896ec3a25c845",
              "status": "affected",
              "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
              "versionType": "git"
            },
            {
              "lessThan": "dfc8373893b1876bb367700eac9d776316dabd96",
              "status": "affected",
              "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
              "versionType": "git"
            },
            {
              "lessThan": "dbd935a9e056545721bc4e9ce518c775d787b21e",
              "status": "affected",
              "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
              "versionType": "git"
            },
            {
              "lessThan": "384a4b2fef9ffe5e270ee5558975c0504881c5fb",
              "status": "affected",
              "version": "a2a4dedf88ab2f807a7ca90947d686816b430f97",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/mgmt.c",
            "net/bluetooth/msft.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: MGMT: Fix adv monitor add failure cleanup\n\nhci_add_adv_monitor() publishes a new adv_monitor in\nhdev-\u003eadv_monitors_idr before the powered MSFT setup step. The MSFT\noffload add path can then fail either locally before the controller add\ncommand completes, or in the MSFT add callback. In the current queued\nmanagement add flow, hci_cmd_sync_work() still invokes\nmgmt_add_adv_patterns_monitor_complete() with the original pending command\nafter msft_add_monitor_pattern() returns.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nMSFT add handling                  MGMT completion\n1. insert monitor and handle       1. receive sync error\n2. send MSFT add command           2. call add-monitor completion\n3. callback sees bad response      3. load cmd-\u003euser_data\n4. callback frees monitor          4. read monitor-\u003ehandle\n\nLocal MSFT setup failures have the other half of the same ownership bug:\nthey return an error after the IDR insertion, but no later code removes the\nfailed monitor from the IDR.\n\nKeep ownership with the pending management command until its completion.\nFor normal management adds, the MSFT add callback now records successful\ncontroller state and returns errors to its caller. The management\ncompletion frees the monitor on non-success after copying the response\nhandle, while resume/reregister callback-error cleanup remains in the\nMSFT callback. The success path keeps the existing bookkeeping.\n\nValidation reproduced this kernel report:\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x66/0xa0\n print_report+0xce/0x5f0\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __virt_addr_valid+0x19f/0x330\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n kasan_report+0xe0/0x110\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? 0xffffffffc00d00da\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]\n hci_cmd_sync_work+0x1c0/0x210 [bluetooth]\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\n process_one_work+0x4fd/0xbc0\n ? __pfx_process_one_work+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __list_add_valid_or_report+0x37/0xf0\n ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]\n ? srso_alias_return_thunk+0x5/0xfbef5\n worker_thread+0x2d8/0x570\n ? __pfx_worker_thread+0x10/0x10\n kthread+0x1ad/0x1f0\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x3c9/0x540\n ? __pfx_ret_from_fork+0x10/0x10\n ? srso_alias_return_thunk+0x5/0xfbef5\n ? __switch_to+0x2e9/0x730\n ? __pfx_kthread+0x10/0x10\n ret_from_fork_asm+0x1a/0x30\n \u003c/TASK\u003e\n\nAllocated by task 471 on cpu 3 at 285.205389s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n __kasan_kmalloc+0xaa/0xb0\n add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\n __sys_sendto+0x2bc/0x2d0\n __x64_sys_sendto+0x76/0x90\n do_syscall_64+0x115/0x6a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFreed by task 454 on cpu 2 at 285.217112s:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x17/0x60\n kasan_save_free_info+0x3b/0x60\n __kasan_slab_free+0x5f/0x80\n kfree+0x313/0x590\n msft_add_monitor_sync+0x54a/0x570 [bluetooth]\n hci_add_adv_monitor+0x133/0x180 [bluetooth]\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\n process_one_work+0x4fd/0xbc0\n worker_thread+0x2d8/0x570\n kthread+0x1ad/0x1f0\n ret_from_fork+0x3c9/0x540\n ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached by a local process sending MGMT_OP_ADD_ADV_PATTERNS_MONITOR(_RSSI) on a PF_BLUETOOTH HCI_CHANNEL_CONTROL socket via sendto(); remote Bluetooth peers cannot inject MGMT commands, matching prior CNA scoring for the same adv-monitor MGMT path.\nAC:L - On MSFT-capable controllers the attacker fully controls the add-monitor request and can repeatedly submit patterns/RSSI values that cause the MSFT offload add to fail, deterministically driving the callback-free-then-completion-dereference sequence without uncontrollable races.\nPR:L - The handler lacks HCI_MGMT_UNTRUSTED, so the socket must be trusted via CAP_NET_ADMIN; namespace-scoped capability checks allow an unprivileged local user to satisfy this through user namespaces, and session users can also reach it via BlueZ.\nUI:N - Exploitation requires only programmatic MGMT commands from the attacker process; no victim interaction such as pairing, accepting connections, or mounting resources is needed once the required local privileges are available.\nS:U - Impact is kernel slab corruption and Bluetooth MGMT state misuse within the same kernel security authority; it does not cross VM, IOMMU, or sandbox boundaries into a separate security scope.\nC:H - This is a slab use-after-free of struct adv_monitor: mgmt_add_adv_patterns_monitor_complete reads monitor-\u003ehandle after msft_le_monitor_advertisement_cb kfree()s it, enabling reclaimed-object reads and information disclosure under conservative kernel UAF guidance.\nI:H - Freed adv_monitor slabs can be reallocated with attacker-influenced data and abused through subsequent kernel dereferences and heap manipulation, providing a plausible path to arbitrary memory corruption and control-flow hijack beyond a simple crash.\nA:H - The bug was validated with KASAN slab-use-after-free in mgmt_add_adv_patterns_monitor_complete, and repeated failing MSFT add attempts can trigger kernel oops/panic from dereferencing freed monitor memory."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:42:55.650Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b1a719b3c4359ef731646fb7c7844e53dddbda72"
        },
        {
          "url": "https://git.kernel.org/stable/c/5aabbd01ac315a72bcdfd42985ede712c4744689"
        },
        {
          "url": "https://git.kernel.org/stable/c/fb256d07395ebbc950f42e439d3896ec3a25c845"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfc8373893b1876bb367700eac9d776316dabd96"
        },
        {
          "url": "https://git.kernel.org/stable/c/dbd935a9e056545721bc4e9ce518c775d787b21e"
        },
        {
          "url": "https://git.kernel.org/stable/c/384a4b2fef9ffe5e270ee5558975c0504881c5fb"
        }
      ],
      "title": "Bluetooth: MGMT: Fix adv monitor add failure cleanup",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72335",
    "datePublished": "2026-08-15T05:55:43.847Z",
    "dateReserved": "2026-08-09T03:40:39.920Z",
    "dateUpdated": "2026-08-17T05:42:55.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72335",
      "date": "2026-09-04",
      "epss": "0.00171",
      "percentile": "0.06661"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72335\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:06.677\",\"lastModified\":\"2026-08-17T06:18:37.127\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: MGMT: Fix adv monitor add failure cleanup\\n\\nhci_add_adv_monitor() publishes a new adv_monitor in\\nhdev-\u003eadv_monitors_idr before the powered MSFT setup step. The MSFT\\noffload add path can then fail either locally before the controller add\\ncommand completes, or in the MSFT add callback. In the current queued\\nmanagement add flow, hci_cmd_sync_work() still invokes\\nmgmt_add_adv_patterns_monitor_complete() with the original pending command\\nafter msft_add_monitor_pattern() returns.\\n\\nThe buggy scenario involves two paths, with each column showing the order\\nwithin that path:\\n\\nMSFT add handling                  MGMT completion\\n1. insert monitor and handle       1. receive sync error\\n2. send MSFT add command           2. call add-monitor completion\\n3. callback sees bad response      3. load cmd-\u003euser_data\\n4. callback frees monitor          4. read monitor-\u003ehandle\\n\\nLocal MSFT setup failures have the other half of the same ownership bug:\\nthey return an error after the IDR insertion, but no later code removes the\\nfailed monitor from the IDR.\\n\\nKeep ownership with the pending management command until its completion.\\nFor normal management adds, the MSFT add callback now records successful\\ncontroller state and returns errors to its caller. The management\\ncompletion frees the monitor on non-success after copying the response\\nhandle, while resume/reregister callback-error cleanup remains in the\\nMSFT callback. The success path keeps the existing bookkeeping.\\n\\nValidation reproduced this kernel report:\\nBUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\\n\\nCall Trace:\\n \u003cTASK\u003e\\n dump_stack_lvl+0x66/0xa0\\n print_report+0xce/0x5f0\\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __virt_addr_valid+0x19f/0x330\\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\\n kasan_report+0xe0/0x110\\n ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\\n mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? 0xffffffffc00d00da\\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\\n ? hci_cmd_sync_work+0x1ab/0x210 [bluetooth]\\n hci_cmd_sync_work+0x1c0/0x210 [bluetooth]\\n ? __pfx_mgmt_add_adv_patterns_monitor_complete+0x10/0x10 [bluetooth]\\n process_one_work+0x4fd/0xbc0\\n ? __pfx_process_one_work+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __list_add_valid_or_report+0x37/0xf0\\n ? __pfx_hci_cmd_sync_work+0x10/0x10 [bluetooth]\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n worker_thread+0x2d8/0x570\\n ? __pfx_worker_thread+0x10/0x10\\n kthread+0x1ad/0x1f0\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x3c9/0x540\\n ? __pfx_ret_from_fork+0x10/0x10\\n ? srso_alias_return_thunk+0x5/0xfbef5\\n ? __switch_to+0x2e9/0x730\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork_asm+0x1a/0x30\\n \u003c/TASK\u003e\\n\\nAllocated by task 471 on cpu 3 at 285.205389s:\\n kasan_save_stack+0x33/0x60\\n kasan_save_track+0x17/0x60\\n __kasan_kmalloc+0xaa/0xb0\\n add_adv_patterns_monitor_rssi+0xd5/0x230 [bluetooth]\\n hci_sock_sendmsg+0x96b/0xf80 [bluetooth]\\n __sys_sendto+0x2bc/0x2d0\\n __x64_sys_sendto+0x76/0x90\\n do_syscall_64+0x115/0x6a0\\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n\\nFreed by task 454 on cpu 2 at 285.217112s:\\n kasan_save_stack+0x33/0x60\\n kasan_save_track+0x17/0x60\\n kasan_save_free_info+0x3b/0x60\\n __kasan_slab_free+0x5f/0x80\\n kfree+0x313/0x590\\n msft_add_monitor_sync+0x54a/0x570 [bluetooth]\\n hci_add_adv_monitor+0x133/0x180 [bluetooth]\\n hci_cmd_sync_work+0x187/0x210 [bluetooth]\\n process_one_work+0x4fd/0xbc0\\n worker_thread+0x2d8/0x570\\n kthread+0x1ad/0x1f0\\n ret_from_fork+0x3c9/0x540\\n ret_from_fork_asm+0x1a/0x30\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/mgmt.c\",\"net/bluetooth/msft.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\"lessThan\":\"b1a719b3c4359ef731646fb7c7844e53dddbda72\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\"lessThan\":\"5aabbd01ac315a72bcdfd42985ede712c4744689\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\"lessThan\":\"fb256d07395ebbc950f42e439d3896ec3a25c845\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\"lessThan\":\"dfc8373893b1876bb367700eac9d776316dabd96\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\"lessThan\":\"dbd935a9e056545721bc4e9ce518c775d787b21e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a2a4dedf88ab2f807a7ca90947d686816b430f97\",\"lessThan\":\"384a4b2fef9ffe5e270ee5558975c0504881c5fb\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/mgmt.c\",\"net/bluetooth/msft.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/384a4b2fef9ffe5e270ee5558975c0504881c5fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5aabbd01ac315a72bcdfd42985ede712c4744689\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b1a719b3c4359ef731646fb7c7844e53dddbda72\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dbd935a9e056545721bc4e9ce518c775d787b21e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dfc8373893b1876bb367700eac9d776316dabd96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fb256d07395ebbc950f42e439d3896ec3a25c845\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-18T23:50:09+00:00",
      "cve": "CVE-2026-72335",
      "id": "CVE-2026-72335",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: MGMT: Fix adv monitor add failure cleanup",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72335.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.