Linux Kernel Bluetooth Buffer Overflow Vulnerability in mgmt_mesh_add

A buffer overflow vulnerability has been identified in the Bluetooth management function mgmt_mesh_add() of the Linux kernel. The issue arises because the function accepts a parameter length that can exceed the allocated size of the destination buffer, leading to potential memory corruption. Specifically, the 'mesh_tx->param' array is designed to hold 48 bytes, but the function can incorrectly process lengths greater than 50 bytes, allowing for a buffer overflow.

Impact

Exploitation of this vulnerability leads to a buffer overflow, which can commonly result in arbitrary code execution or memory corruption.