CVE-2026-43134

Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

Published May 6, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

This adds a check for encryption key size upon receiving
L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which
expects L2CAP_CR_LE_BAD_KEY_SIZE.

Analysis

Technical impact

The Linux kernel’s Bluetooth L2CAP module lacks validation of the encryption key size when it receives an L2CAP_LE_CONN_REQ. This omission allows a remote party to embed an illegal or weak key length into a connection request, which the kernel would accept and use for establishing a secure channel. The result is that a BLE link could operate with sub‑optimal encryption, exposing the confidentiality and integrity of the traffic over that link.

Affected Systems

Any Linux kernel build that predates the commit adding the key‑size check is vulnerable. This includes all distributions that ship an unpatched kernel, regardless of version, as no specific release range is provided in the advisory.

Risk and Exploitability

The flaw is triggered whenever a Bluetooth controller processes an L2CAP_LE_CONN_REQ, so a nearby device equipped with Bluetooth can transmit a crafted request to exploit it. The CVSS score of 8.1 indicates moderate‑to‑high severity, but the EPSS score is < 1% and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a remote Bluetooth‑enabled device that can send a malformed packet, leading to a link that operates with a weak or malformed encryption key and potentially allowing eavesdropping or tampering.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< 335071c0c3637064ec250481f589075db44fe4e6
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< fa6ad76fa8623c0a50d529cd5726fa5d819a3be4
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< 9118601ff90b79e8df3c0c98f48ae00c1b02ecef
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< 481ea39b342c347b6ac029f3d418486280be4e45
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< ec91078e132179b04e0c3906b599816c056ceaad
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< 96581749c7c14fbec32c35728520867929600041
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< 8dd43f9a9323f9c01bc8246da8d81a4c783c9e97
`27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d`	affected	< 138d7eca445ef37a0333425d269ee59900ca1104

Linux

affected

Version	Status	Constraints
`3.14`	affected	—
`0`	unaffected	< 3.14
`5.10.252`	unaffected	≤ 5.10.*
`5.15.202`	unaffected	≤ 5.15.*
`6.1.165`	unaffected	≤ 6.1.*
`6.6.128`	unaffected	≤ 6.6.*
`6.12.75`	unaffected	≤ 6.12.*
`6.18.16`	unaffected	≤ 6.18.*
`6.19.6`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,335071c0c3637064ec250481f589075db44fe4e6)`	affected	code_commit	—
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,fa6ad76fa8623c0a50d529cd5726fa5d819a3be4)`	affected	code_commit	—
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,9118601ff90b79e8df3c0c98f48ae00c1b02ecef)`	affected	code_commit	—
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,481ea39b342c347b6ac029f3d418486280be4e45)`	affected	code_commit	—
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,ec91078e132179b04e0c3906b599816c056ceaad)`	affected	code_commit	—
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,96581749c7c14fbec32c35728520867929600041)`	affected	code_commit	—
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,8dd43f9a9323f9c01bc8246da8d81a4c783c9e97)`	affected	code_commit	—
`[27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d,138d7eca445ef37a0333425d269ee59900ca1104)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.14`	affected	generic	—
`[0,3.14)`	unaffected	generic	—
`[5.10.252,5.11.0)`	unaffected	semver	—
`[5.15.202,5.16.0)`	unaffected	semver	—
`[6.1.165,6.2.0)`	unaffected	semver	—
`[6.6.128,6.7.0)`	unaffected	semver	—
`[6.12.75,6.13.0)`	unaffected	semver	—
`[6.18.16,6.19.0)`	unaffected	semver	—
`[6.19.6,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply a kernel update that contains the commit adding key‑size validation for L2CAP_LE_CONN_REQ.
If an upgrade cannot be performed immediately, disable or unload the kernel Bluetooth subsystem to prevent external connection attempts.
Limit incoming Bluetooth connections to trusted devices by configuring the host firewall or Bluetooth manager, thereby reducing exposure until the patch is applied.

Generated by OpenCVE AI on October 23, 2026 at 02:23 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4606-1	linux security update
Ubuntu USN	USN-8492-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8492-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8497-1	Linux kernel (Low Latency) vulnerabilities
Ubuntu USN	USN-8498-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8499-1	Linux kernel (Xilinx) vulnerabilities
Ubuntu USN	USN-8492-3	Linux kernel (Raspberry Pi Real-time) vulnerabilities
Ubuntu USN	USN-8492-4	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8492-5	Linux kernel (FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8597-1	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8668-2	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.117% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104
https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6
https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45
https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97
https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef
https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041
https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad
https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4
https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43134-ce6b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43134
https://www.cve.org/CVERecord?id=CVE-2026-43134

History

Oct 19, 2026 8:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-326

Oct 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 12, 2026 9:15 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::

May 8, 2026 1:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}`

May 7, 2026 3:30 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-20 CWE-613

May 7, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-1284
References		https://lore.kernel.org/linux-cve-announce/2026050622-CVE-2026-43134-ce6b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43134 https://www.cve.org/CVERecord?id=CVE-2026-43134
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

May 6, 2026 4:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-20 CWE-613

May 6, 2026 12:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE.
Title		Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104 https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6 https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45 https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97 https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041 https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4