The vulnerability is in the Linux kernel's Bluetooth Security Manager Protocol (SMP). In legacy responder pairing, the code incorrectly flags the stored Session Temporary Key (STK) as authenticated whenever the local requester asks for high security, even when no Man‑in‑the‑Middle (MITM) protection was actually performed. This means that a Just Works or Just Confirm pairing can be treated as if vigorous authentication had occurred, potentially letting a device that only supports legacy pairing be granted higher privileges or access to sensitive Bluetooth services. The weakness stems from improper handling of authentication state, documented as CWE‑372.

Vendors: Linux. Product: Linux kernel. The vulnerability affects kernel versions that lack the SMP/STK authentication fix referenced in the commit history. The CPE list includes kernel 3.16 and 7.0 release candidates (rc1‑rc6). Administrators should consult the kernel changelog or vendor notes for the specific patch commit that resolves the issue, and ensure their systems are running a kernel version that incorporates the fix.

The CVSS score of 8.8 indicates a high severity impact. The EPSS score of less than 1% suggests a low but non‑zero exploitation probability. The flaw is not listed in CISA's KEV catalog, and no public exploits are cited in the references. Exploitation requires the attacker to perform a Bluetooth pairing transaction, typically within range of the target device. If an attacker can initiate a Just Works or Just Confirm pairing, the system may consider the connection to have high security when it does not, potentially allowing unauthorized Bluetooth actions. The risk is therefore significant for devices that rely on Bluetooth security levels for access control, but the attack is limited to the Bluetooth pairing context and does not provide arbitrary code execution.