The vulnerability lies in the Linux kernel’s Bluetooth SMP pairing logic. When a device that requires high security initiates pairing, the kernel builds a response that omits the required MITM flag if the initiator does not request it. This mismatch allows an attacker to pair without MITM enforcement, effectively weakening the connection’s security and permitting a man‑in‑the‑middle attack. The flaw is a logic error that undermines the intended confidentiality and integrity protections of Bluetooth communications.

Linux kernel devices. The affected code is part of the Bluetooth stack, and the security premise applies to any kernel that incorporates the unpatched SMP logic. Specific version ranges are not listed, so all current or near‑current kernel releases should be considered potentially vulnerable until the patch is applied.

Because the issue resides in the pairing protocol, an attacker who can conduct a Bluetooth pairing session with a high‑security device can force the responder to accept a weaker authentication state. The pipe for exploitation is a local Bluetooth connection; physical proximity or range of typical Bluetooth devices is sufficient. No public exploits are reported, and the EPSS score is unavailable, but the condition is straightforward and the impact severe. The vulnerability is not listed in CISA’s KEV catalog, yet it remains a critical security concern for environments that rely on Bluetooth for sensitive communications.