The vulnerability results from a logic error in the Linux kernel’s Bluetooth Security Manager Pairing (SMP) controller. The kernel constructs a pairing response using the initiator’s auth_req before checking that the local device’s high‑security policy mandates man‑in‑the‑middle (MITM) protection. If the initiator omits the MITM flag, the responder can reply without enforcing it, causing a weaker authentication state than the policy requires. This creates an opportunity for an attacker to hijack the pairing process, diminishing Bluetooth communication confidentiality and integrity.

The defect resides in the generic Linux kernel Bluetooth subsystem; all kernels containing the unpatched SMP logic are potentially vulnerable. No specific version ranges are listed, so any current or near‑current Linux kernel release should be considered at risk until the MITM enforcement patch is applied.

Based on the description, the likely attack vector is a local Bluetooth pairing session. An adversary would need to be within typical Bluetooth range of the target device and initiate a pairing with a high‑security requirement. The EPSS score is below 1% and no public exploits are known, so the practical risk is moderate, but the CVSS base score of 8.8 signals a high severity. The vulnerability is not listed in the CISA KEV catalog, yet it remains a concern for environments that rely on high‑security Bluetooth connections.