CVE-2026-31511

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete

This fixes the condition checking so mgmt_pending_valid is executed

whenever status != -ECANCELED otherwise calling mgmt_pending_free(cmd)

would kfree(cmd) without unlinking it from the list first, leaving a

dangling pointer. Any subsequent list traversal (e.g.,

mgmt_pending_foreach during __mgmt_power_off, or another

mgmt_pending_valid call) would dereference freed memory.