CVE-2026-72335

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth MGMT component where a slab-use-after-free occurs during the cleanup of an advertising monitor addition failure. The function hci add adv monitor() publishes a new adv monitor in hdev->adv monitors idr before the MSFT setup step. If the MSFT offload add path fails locally or within the MSFT add callback, the monitor may be freed while hci cmd sync work() still invokes mgmt add adv patterns monitor complete() using the original pending command. This leads to a scenario where the completion function attempts to read monitor->handle after the monitor has already been freed. Additionally, local MSFT setup failures may return an error without removing the failed monitor from the IDR.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.