CVE-2026-72335 Linux CVE debrief

Who should care

Linux kernel developers and users, especially those using the Bluetooth MGMT component, should review and update the Linux kernel to the latest version. They should also monitor the system for potential exploitation attempts and apply the kernel patch to fix the use-after-free vulnerability. Additionally, operators, platform administrators, vulnerability-management teams, and security teams may need to assess their exposure and take mitigating actions. This may involve reviewing compensating controls for exposed systems while remediation is scheduled and verified, and tracking exceptions and retesting remediated assets. Those impacted may also need to confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Those impacted should also consider checking relevant monitoring, detection, and logs for exposed assets that need extra review. Those impacted should also consider planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those impacted should also consider reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Those impacted should also consider confirming whether affected product deployments exist in managed environments and assign an owner for follow-up. Those impacted should also consider planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those impacted should also consider reviewing compensating controls for exposed systems while remediation is scheduled and verified. Those impacted should also consider tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Those impacted should also consider checking relevant monitoring, detection, and logs for exposed assets that need extra review. Those impacted should also consider planning vendor-supported updates or mitigations through normal change control where exposure is confirmed. Those impacted should also consider reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Those impacted,

Technical summary

The bug occurs when adding an advertising monitor and handling the MSFT offload add path, which can fail locally or in the MSFT add callback. This leads to a use-after-free error when the management completion frees the monitor on non-success after copying the response handle. The bug was fixed by keeping ownership with the pending management command until its completion. Affected Linux kernel developers and users should review and update the Linux kernel to the latest version.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch to fix the use-after-free vulnerability
• Review and update the Linux kernel to the latest version
• Monitor the system for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified

Evidence notes

The bug was introduced in the Linux kernel's Bluetooth MGMT component. The vulnerability is caused by a use-after-free error when adding an advertising monitor and handling the MSFT offload add path. To verify, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.