Riskcovery

CVE-2026-43134

Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

State
Published
Severity
8.1 High
Published
May 6, 2026
Updated
Oct 19, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE.

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NLinux

Weaknesses

  • CWE-326 Inadequate Encryption Strength

Affected Products

ProductVersions
LinuxLinux
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before 335071c0c3637064ec250481f589075db44fe4e6Affected
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before fa6ad76fa8623c0a50d529cd5726fa5d819a3be4Affected
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before 9118601ff90b79e8df3c0c98f48ae00c1b02ecefAffected
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before 481ea39b342c347b6ac029f3d418486280be4e45Affected
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before ec91078e132179b04e0c3906b599816c056ceaadAffected
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before 96581749c7c14fbec32c35728520867929600041Affected
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before 8dd43f9a9323f9c01bc8246da8d81a4c783c9e97Affected
  • 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d to before 138d7eca445ef37a0333425d269ee59900ca1104Affected
LinuxLinux
  • 3.14Affected
  • before 3.14Not affected
  • 5.10.252 through 5.10.*Not affected
  • 5.15.202 through 5.15.*Not affected
  • 6.1.165 through 6.1.*Not affected
  • 6.6.128 through 6.6.*Not affected
  • 6.12.75 through 6.12.*Not affected
  • 6.18.16 through 6.18.*Not affected
  • 6.19.6 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.