CVE-2026-31773
Bluetooth SMP STK Authentication Bypass in Linux Kernel
Publication date: 2026-05-01
Last updated on: 2026-05-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's Bluetooth Secure Simple Pairing (SMP) implementation. Specifically, the legacy responder path in the smp_random() function incorrectly labels the stored Short Term Key (STK) as authenticated whenever the pending security level is set to BT_SECURITY_HIGH. However, this reflects only what the local service requested, not the actual outcome of the pairing process.
For Just Works or Confirm legacy pairing methods, the SMP_FLAG_MITM_AUTH flag remains clear, meaning the resulting STK should be considered unauthenticated even if the local side requested high security. The vulnerability is that the code did not properly use the established Man-In-The-Middle (MITM) state when storing the responder STK, causing a mismatch between key metadata and the actual pairing result.
The fix aligns the legacy pairing path with the Secure Connections code, which already treats Just Works and Just Confirm pairing methods as unauthenticated, ensuring the STK's authentication status correctly reflects the pairing method's security.
How can this vulnerability impact me? :
This vulnerability can lead to a false sense of security by incorrectly marking a Bluetooth pairing key as authenticated when it is not. This means that devices might believe they have a higher level of protection against man-in-the-middle attacks than they actually do.
As a result, attackers could potentially exploit this mislabeling to intercept or manipulate Bluetooth communications that were assumed to be secure, increasing the risk of unauthorized access or data interception.