Linux Kernel EUVD-2026-26616

The Linux kernel Bluetooth Management (MGMT) interface processes mesh networking commands through the mesh_send() function. The vulnerability exists in the MGMT_OP_MESH_SEND command handler, which defines a flexible array structure with a fixed header (MGMT_MESH_SEND_SIZE) followed by variable-length advertising data (adv_data[]). The root cause is insufficient validation: the function checks that the total command length falls within 20-50 bytes but never verifies that the adv_data_len field value matches the actual bytes provided in the command buffer. When a truncated command is queued, the async mesh transmission path later reads past the allocated buffer using the unvalidated adv_data_len value. This is a classic buffer over-read condition in flexible array handling, where the embedded length field (adv_data_len) disagrees with the actual received data size.