CVE-2025-39889
BaseFortify
Publication date: 2025-09-24
Last updated on: 2026-04-02
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.11 (inc) to 5.15.181 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.135 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.6.88 (exc) |
| linux | linux_kernel | From 6.7 (inc) to 6.12.25 (exc) |
| linux | linux_kernel | From 6.13 (inc) to 6.14.4 (exc) |
| linux | linux_kernel | 6.15 |
| linux | linux_kernel | 6.15 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-326 | The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel's Bluetooth l2cap component involves improper checking of the encryption key size on incoming connections. Specifically, the system does not enforce the required 16-byte encryption key size mandated by Security Mode 4 Level 4, allowing connections with smaller keys (1 to 15 bytes). This causes the system to accept connections that should be refused due to insufficient encryption strength.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing Bluetooth connections that use weaker encryption keys than required, potentially exposing your device to security risks such as unauthorized access or data interception. Because the system accepts connections with smaller-than-required encryption keys, attackers might exploit this to bypass security controls and compromise the confidentiality and integrity of Bluetooth communications.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could negatively affect compliance with security requirements in standards and regulations like GDPR and HIPAA, which mandate strong protection of sensitive data. Accepting Bluetooth connections with insufficient encryption key sizes may lead to weaker data protection, increasing the risk of unauthorized data access or breaches, thereby potentially violating these regulations' security obligations.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection involves monitoring Bluetooth L2CAP connection attempts and checking the encryption key size used in incoming connections. Specifically, you can analyze HCI logs for the 'Read Encryption Key Size' command and verify if the key size is less than the required 16 bytes for Security Mode 4 Level 4. Commands to capture such logs include using 'btmon' to monitor Bluetooth traffic and 'hcidump' to capture HCI events. For example, running 'sudo btmon' or 'sudo hcidump' on the affected system can help observe the encryption key size during connection attempts.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves ensuring that the Bluetooth stack enforces the minimum encryption key size of 16 bytes for Security Mode 4 Level 4 connections. Applying the patch or update that fixes the vulnerability in the Linux kernel Bluetooth L2CAP component is necessary. Until then, restricting Bluetooth connections to trusted devices and disabling Bluetooth if not needed can reduce exposure.