In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix adv monitor add failure cleanup

hci_add_adv_monitor() publishes a new adv_monitor in
hdev->adv_monitors_idr before the powered MSFT setup step. The MSFT
offload add path can then fail either locally before the controller add
command completes, or in the MSFT add callback. In the current queued
management add flow, hci_cmd_sync_work() still invokes
mgmt_add_adv_patterns_monitor_complete() with the original pending command
after msft_add_monitor_pattern() returns.

The buggy scenario involves two paths, with each column showing the order
within that path:

MSFT add handling                  MGMT completion
1. insert monitor and handle       1. receive sync error
2. send MSFT add command           2. call add-monitor completion
3. callback sees bad response      3. load cmd->user_data
4. callback frees monitor          4. read monitor->handle

Local MSFT setup failures have the other half of the same ownership bug:
they return an error after the IDR insertion, but no later code removes the
failed monitor from the IDR.

Keep ownership with the pending management command until its completion.
For normal management adds, the MSFT add callback now records successful
controller state and returns errors to its caller. The management
completion frees the monitor on non-success after copying the response
handle, while resume/reregister callback-error cleanup remains in the
MSFT callback. The success path keeps the existing bookkeeping.

Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]

Call Trace:
 <TASK>
 dump_stack_lvl+0x66/0xa0
 print_report+0xce/0x5f0
 ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
 ? srso_alias_return_thunk+0x5/0xfbef5
 ? __virt_addr_valid+0x19f/0x330
 ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
 kasan_report+0xe0/0x110
 ? mgmt_add_adv_patterns_monitor_complete+0xfb/0x260 [bluetooth]
 mgm

https://git.kernel.org/stable/c/384a4b2fef9ffe5e270ee5558975c0504881c5fb

https://git.kernel.org/stable/c/5aabbd01ac315a72bcdfd42985ede712c4744689

https://git.kernel.org/stable/c/b1a719b3c4359ef731646fb7c7844e53dddbda72

https://git.kernel.org/stable/c/dbd935a9e056545721bc4e9ce518c775d787b21e

https://git.kernel.org/stable/c/dfc8373893b1876bb367700eac9d776316dabd96

https://git.kernel.org/stable/c/fb256d07395ebbc950f42e439d3896ec3a25c845

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/bluetooth/mgmt.c","net/bluetooth/msft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"a2a4dedf88ab2f807a7ca90947d686816b430f97","lessThan":"b1a719b3c4359ef731646fb7c7844e53dddbda72","versionType":"git","status":"affected"},{"version":"a2a4dedf88ab2f807a7ca90947d686816b430f97","lessThan":"5aabbd01ac315a72bcdfd42985ede712c4744689","versionType":"git","status":"affected"},{"version":"a2a4dedf88ab2f807a7ca90947d686816b430f97","lessThan":"fb256d07395ebbc950f42e439d3896ec3a25c845","versionType":"git","status":"affected"},{"version":"a2a4dedf88ab2f807a7ca90947d686816b430f97","lessThan":"dfc8373893b1876bb367700eac9d776316dabd96","versionType":"git","status":"affected"},{"version":"a2a4dedf88ab2f807a7ca90947d686816b430f97","lessThan":"dbd935a9e056545721bc4e9ce518c775d787b21e","versionType":"git","status":"affected"},{"version":"a2a4dedf88ab2f807a7ca90947d686816b430f97","lessThan":"384a4b2fef9ffe5e270ee5558975c0504881c5fb","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/bluetooth/mgmt.c","net/bluetooth/msft.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.12","status":"affected"},{"version":"0","lessThan":"5.12","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc3","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]