The vulnerability exposes that the legacy responder path in the Bluetooth SMP stack incorrectly labels a Session Temporary Key as authenticated whenever the connection requests high security, regardless of whether Man‑in‑the‑Middle authentication was actually performed. This mislabeling can allow an attacker who performs a Just Works or Just Confirm pairing to be treated as if vigorous authentication had occurred, potentially granting unauthorized access to privileged Bluetooth operations or data. The weakness reflects improper handling of authentication state and could be exploited to elevate a connection’s security level without genuine proof of MITM protection.

Vendors: Linux. Product: Linux kernel. Exact affected kernel releases are not listed in the entry, so administrators should refer to the latest kernel release notes for any mentions of the SMP/STK authentication fix.

This flaw mislabels a Session Temporary Key as authenticated even when no MITM has been performed. The impact is that an attacker who carries out a Just Works pairing could be treated as if a high security level had been achieved. The CVSS score is not specified and EPSS is unavailable, and the vulnerability is not in KEV, so no public severity metrics are provided. Because the flaw involves authentication state misclassification rather than a direct control‑flow escape, exploitability depends on the ability to carry out a pairing transaction. No evidence of known exploits is reported in the references, so it is unclear how often this can be abused. It is inferred from the limited data that the risk may not be severe, but the potential for privilege escalation via incorrect authentication suggests it remains a concern.