CVE-2026-31773: Bluetooth: SMP: derive legacy responder STK authentication from MITM state
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The legacy responder path in smprandom() currently labels the stored STK as authenticated whenever pendingseclevel is BTSECURITYHIGH. That reflects what the local service requested, not what the pairing flow actually achieved.
For Just Works/Confirm legacy pairing, SMPFLAGMITMAUTH stays clear and the resulting STK should remain unauthenticated even if the local side requested HIGH security. Use the established MITM state when storing the responder STK so the key metadata matches the pairing result.
This also keeps the legacy path aligned with the Secure Connections code, which already treats JUSTWORKS/JUSTCFM as unauthenticated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31773?
CVE-2026-31773 is classified as a moderate severity vulnerability in the Linux kernel affecting Bluetooth authentication.
How do I fix CVE-2026-31773?
To fix CVE-2026-31773, update your Linux kernel to the latest version that contains the patch addressing this vulnerability.
What systems are affected by CVE-2026-31773?
CVE-2026-31773 affects Linux kernel versions prior to the fix that addresses the Bluetooth SMP authentication vulnerability.
What are the potential impacts of CVE-2026-31773?
Exploitation of CVE-2026-31773 could potentially allow attackers to bypass Bluetooth security measures, leading to unauthorized access or man-in-the-middle attacks.
Is CVE-2026-31773 being actively exploited?
As of the latest reports, there is no indication that CVE-2026-31773 is being actively exploited in the wild.