The Linux kernel’s Bluetooth L2CAP module lacks validation of the encryption key size when it receives an L2CAP_LE_CONN_REQ. This omission allows a remote party to embed an illegal or weak key length into a connection request, which the kernel would accept and use for establishing a secure channel. The result is that a BLE link could operate with sub‑optimal encryption, exposing the confidentiality and integrity of the traffic over that link.

Any Linux kernel build that predates the commit adding the key‑size check is vulnerable. This includes all distributions that ship an unpatched kernel, regardless of version, as no specific release range is provided in the advisory.

The flaw is triggered whenever a Bluetooth controller processes an L2CAP_LE_CONN_REQ, so a nearby device equipped with Bluetooth can transmit a crafted request to exploit it. The CVSS score of 7.0 indicates moderate‑to‑high severity, but the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. The most likely attack vector is a remote Bluetooth‑enabled device that can send a malformed packet, leading to a link that operates with a weak or malformed encryption key and potentially allowing eavesdropping or tampering.