CVE-2026-31773
published 2026-05-01CVE-2026-31773: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: derive legacy responder STK authentication from MITM state The legacy…
PriorityP349high8.8CVSS 3.1
AVAACLPRNUINSUCHIHAH
EPSS
0.28%
20.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.
For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.
This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 3.15.5 < 3.16 | 3.16 |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < 9a38659a3d06080715691bd3139f9c4b61f688e3 | 9a38659a3d06080715691bd3139f9c4b61f688e3 |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < 667f44f1392df6482483756458c48670e579e9ff | 667f44f1392df6482483756458c48670e579e9ff |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < 929db734d12db41ca5f95424db4612397f1bd4a7 | 929db734d12db41ca5f95424db4612397f1bd4a7 |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < b1c6a8e554a39b222c0879a288ea98e338fc4d77 | b1c6a8e554a39b222c0879a288ea98e338fc4d77 |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < 0afc846bd80073ffcd2b8040f2b2fafaea3d9f72 | 0afc846bd80073ffcd2b8040f2b2fafaea3d9f72 |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < 061ee71ac6b03c9f8432fe49538c3682bfcf4cf3 | 061ee71ac6b03c9f8432fe49538c3682bfcf4cf3 |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < 9a6d0db176f082685e0b6149700c0baf3ce2aa8b | 9a6d0db176f082685e0b6149700c0baf3ce2aa8b |
| linux | linux | >= fff3490f47810e2d34b91fb9e31103e923b11c2f < 20756fec2f0108cb88e815941f1ffff88dc286fe | 20756fec2f0108cb88e815941f1ffff88dc286fe |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 3.15.5 < 3.16 | 3.16 |
| linux | linux_kernel | >= 3.16.1 < 5.10.253 | 5.10.253 |
| linux | linux_kernel | >= 5.11 < 5.15.203 | 5.15.203 |
| linux | linux_kernel | >= 5.16 < 6.1.168 | 6.1.168 |
| linux | linux_kernel | >= 6.13 < 6.18.22 | 6.18.22 |
| linux | linux_kernel | >= 6.19 < 6.19.12 | 6.19.12 |
| linux | linux_kernel | >= 6.2 < 6.6.134 | 6.6.134 |
| linux | linux_kernel | >= 6.7 < 6.12.81 | 6.12.81 |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: Bluetooth: SMP: derive legacy responder STK authentication from MITM state
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-31773 [MEDIUM] CWE-372 kernel: Bluetooth: SMP: derive legacy responder STK authentication from MITM state
kernel: Bluetooth: SMP: derive legacy responder STK authentication from MITM state
A flaw was found in the Linux kernel's Bluetooth Security Manager Protocol (SMP). The system incorrectly labels a Short Term Key (STK) as authenticated during legacy pairing, even when Man-in-the-Middle (MITM) protection was not established. This misrepresentation of the key's authentication status could allow an attacker to bypass expected security measures, potentially leading to unauthorized access or a downgrade of the Bluetooth connection's security.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: ke
GHSA
GHSA-vm8r-x97v-544j: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The l
ghsa_unreviewed·2026-05-01
CVE-2026-31773 [HIGH] GHSA-vm8r-x97v-544j: In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The l
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.
For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.
This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.
VulDB
Linux Kernel up to 6.19.11 smp_random channel accessible
vuldb·2026-05-01
CVE-2026-31773 [CRITICAL] Linux Kernel up to 6.19.11 smp_random channel accessible
A vulnerability, which was classified as critical, has been found in Linux Kernel up to 6.19.11. Affected is the function smp_random. Performing a manipulation results in channel accessible by non-endpoint.
This vulnerability is identified as CVE-2026-31773. The attack can only be performed from the local network. There is not any exploit available.
It is advisable to upgrade the affected component.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/061ee71ac6b03c9f8432fe49538c3682bfcf4cf3https://git.kernel.org/stable/c/0afc846bd80073ffcd2b8040f2b2fafaea3d9f72https://git.kernel.org/stable/c/20756fec2f0108cb88e815941f1ffff88dc286fehttps://git.kernel.org/stable/c/667f44f1392df6482483756458c48670e579e9ffhttps://git.kernel.org/stable/c/929db734d12db41ca5f95424db4612397f1bd4a7https://git.kernel.org/stable/c/9a38659a3d06080715691bd3139f9c4b61f688e3https://git.kernel.org/stable/c/9a6d0db176f082685e0b6149700c0baf3ce2aa8bhttps://git.kernel.org/stable/c/b1c6a8e554a39b222c0879a288ea98e338fc4d77
2026-05-01
Published