CVE-2026-43020

Bluetooth: MGMT: validate LTK enc_size on load

State: Published
Severity: Not scored
Published: May 1, 2026
Updated: May 11, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate LTK enc_size on load

Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer.

Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	346af67b8d116f01ef696fd47959a55deb2db8b6 to before 0f37d1e65c6d71ad94ccfb5c602163c525db789dAffected 346af67b8d116f01ef696fd47959a55deb2db8b6 to before 257cdb960d8ff6d60bb6461b03c814b6cf0c9e64Affected 346af67b8d116f01ef696fd47959a55deb2db8b6 to before c34577f517b556fb6ca173d45bf7e766ae2564ceAffected 346af67b8d116f01ef696fd47959a55deb2db8b6 to before f71695e81f4cb428f3c7e2138eae88199005b52cAffected 346af67b8d116f01ef696fd47959a55deb2db8b6 to before 82f342b3b006ca1d65f4890c05f2ec32fcb808b6Affected 346af67b8d116f01ef696fd47959a55deb2db8b6 to before 50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257Affected 346af67b8d116f01ef696fd47959a55deb2db8b6 to before 40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009Affected 346af67b8d116f01ef696fd47959a55deb2db8b6 to before b8dbe9648d69059cfe3a28917bfbf7e61efd7f15Affected
LinuxLinux	3.4Affected before 3.4Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.134 through 6.6.Not affected 6.12.81 through 6.12.Not affected 6.18.22 through 6.18.Not affected 6.19.12 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

346af67b8d116f01ef696fd47959a55deb2db8b6 to before 0f37d1e65c6d71ad94ccfb5c602163c525db789dAffected
346af67b8d116f01ef696fd47959a55deb2db8b6 to before 257cdb960d8ff6d60bb6461b03c814b6cf0c9e64Affected
346af67b8d116f01ef696fd47959a55deb2db8b6 to before c34577f517b556fb6ca173d45bf7e766ae2564ceAffected
346af67b8d116f01ef696fd47959a55deb2db8b6 to before f71695e81f4cb428f3c7e2138eae88199005b52cAffected
346af67b8d116f01ef696fd47959a55deb2db8b6 to before 82f342b3b006ca1d65f4890c05f2ec32fcb808b6Affected
346af67b8d116f01ef696fd47959a55deb2db8b6 to before 50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257Affected
346af67b8d116f01ef696fd47959a55deb2db8b6 to before 40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009Affected
346af67b8d116f01ef696fd47959a55deb2db8b6 to before b8dbe9648d69059cfe3a28917bfbf7e61efd7f15Affected

LinuxLinux

3.4Affected
before 3.4Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.134 through 6.6.*Not affected
6.12.81 through 6.12.*Not affected
6.18.22 through 6.18.*Not affected
6.19.12 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.