CVE-2026-43334

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-43334

Key Details

CVE	CVE-2026-43334
CVSS Score / Version	8.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is adjacent; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SMP: force responder MITM requirements before building the pairing response

smp_cmd_pairing_req() currently builds the pairing response from the

initiator auth_req before enforcing the local BT_SECURITY_HIGH

requirement. If the initiator omits SMP_AUTH_MITM, the response can

also omit it even though the local side still requires MITM.

tk_request() then sees an auth value without SMP_AUTH_MITM and may

select JUST_CFM, making method selection inconsistent with the pairing

policy the responder already enforces.

When the local side requires HIGH security, first verify that MITM can

be achieved from the IO capabilities and then force SMP_AUTH_MITM in the

response in both rsp.auth_req and auth. This keeps the responder auth bits

and later method selection aligned. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-43334
CVE	https://www.cve.org/CVERecord?id=CVE-2026-43334

Source

Reference

NVD

CVE