https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 04:10:22 +0000 https://vulnerability.circl.lu/vuln/cve-2025-40213 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete</p> <p>There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array.</p> <p>Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove.</p> <p>Use DEFINE_FLEX to declare the flexible array right, and don&#39;t memcpy outside bounds.</p> <p>As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete</p> <p>There is a BUG: KASAN: stack-out-of-bounds in set_mesh_sync due to memcpy from badly declared on-stack flexible array.</p> <p>Another crash is in set_mesh_complete() due to double list_del via mgmt_pending_valid + mgmt_pending_remove.</p> <p>Use DEFINE_FLEX to declare the flexible array right, and don&#39;t memcpy outside bounds.</p> <p>As mgmt_pending_valid removes the cmd from list, use mgmt_pending_free, and also report status on error.</p> https://vulnerability.circl.lu/vuln/cve-2025-40213