The vulnerability causes the Linux kernel to accept Bluetooth connections that use an encryption key smaller than the required 16‑byte value for Security Mode 4 Level 4. As a result, a device could pair with a target using a weak key, potentially allowing the attacker to establish a trusted session without meeting the expected cryptographic strength. The main weakness is a validation failure (CWE‑326). This flaw does not directly expose system secrets but undermines the integrity of the security negotiation process, granting unauthorized access to Bluetooth services that would otherwise be protected.

Linux kernel versions that lack the patch for this check are affected. The affected products include any Linux kernel 6.15 release prior to the commit that implements the key‑size verification. Specific version information is not supplied, but the referenced CPE strings indicate all 6.15 release candidates and the trunk kernel are susceptible.

The CVSS score of 8.1 indicates a high severity vulnerability. The EPSS score of less than 1% shows a very low probability of exploitation, and the flaw is not listed in CISA KEV. Likely attackers would need to first establish a Bluetooth link with the target device and then trigger a connection request using a reduced key length. If successful, the attacker can gain a connection with a minimal amount of encryption, effectively bypassing the intended security policy.