Junglewise Threat Intelligence

CVE-2026-43334: Linux Kernel Bluetooth SMP MITM enforcement bypass in pairing response

CVE-2026-43334 · Severity: high · CVSS 8.8 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A security flaw was identified in the Linux kernel's Bluetooth implementation that could allow an attacker to bypass mandatory security requirements during the device pairing process. Specifically, a device that should require high-security authentication (protection against 'man-in-the-middle' attacks) could be tricked into using a weaker, unauthenticated connection. This could allow an attacker within Bluetooth range to intercept or manipulate data transmitted between paired devices.

Technical details

A vulnerability in the Linux kernel's Bluetooth SMP implementation (net/bluetooth/smp.c) exists where smp_cmd_pairing_req() builds a pairing response based on the initiator's requirements before enforcing local security policies. If a local device requires BT_SECURITY_HIGH but the initiator omits the SMP_AUTH_MITM flag, the responder's generated response would also omit the flag. This causes tk_request() to potentially select the JUST_CFM (Just Works) pairing method, which lacks MITM protection, despite the local policy requiring it. The fix ensures that if the local security level is HIGH, the MITM bit is forced in the pairing response. This is exploitable by an adjacent attacker during the pairing phase.

Affected products

  • Linux Linux Kernel All versions prior to the April 2026 patches

Timeline

  • 2026-03-31: other: Patch authored by Oleh Konko
  • 2026-04-11: patched: Patches merged into various stable branches by Greg Kroah-Hartman
  • 2026-05-08: disclosed: CVE published and NVD record created

References

Related threats