CVE-2026-43020: Bluetooth: MGMT: validate LTK enc_size on load
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: MGMT: validate LTK encsize on load
Load Long Term Keys stores the user-provided encsize and later uses it to size fixed-size stack operations when replying to LE LTK requests. An encsize larger than the 16-byte key buffer can therefore overflow the reply stack buffer.
Reject oversized encsize values while validating the management LTK record so invalid keys never reach the stored key state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
Reject oversized enc_size values while validating Bluetooth management Long Term Key (LTK) records, before storing the key state, so values larger than the 16-byte key buffer cannot reach reply operations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43020?
CVE-2026-43020 has been classified with a high severity due to its potential impact on Bluetooth security mechanisms.
How do I fix CVE-2026-43020?
To fix CVE-2026-43020, update the Linux kernel to the latest version that includes the patch addressing this vulnerability.
Which software is affected by CVE-2026-43020?
CVE-2026-43020 affects the Linux kernel, particularly components related to Bluetooth management.
What attack vectors are associated with CVE-2026-43020?
CVE-2026-43020 can be exploited via malicious Bluetooth devices attempting to interact with vulnerable systems.
What are the potential consequences of CVE-2026-43020 if exploited?
Exploitation of CVE-2026-43020 could lead to unauthorized access and manipulation of Bluetooth communications on affected systems.