{"id":"CVE-2026-31773","revision":"341927d470e34ce0812dce4678fa36b2","records":[{"revision":"341927d470e34ce0812dce4678fa36b2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-31773","aliases":[],"title":"Bluetooth: SMP: derive legacy responder STK authentication from MITM state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: derive legacy responder STK authentication from MITM state\n\nThe legacy responder path in smp_random() currently labels the stored\nSTK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.\nThat reflects what the local service requested, not what the pairing\nflow actually achieved.\n\nFor Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear\nand the resulting STK should remain unauthenticated even if the local\nside requested HIGH security. Use the established MITM state when\nstoring the responder STK so the key metadata matches the pairing result.\n\nThis also keeps the legacy path aligned with the Secure Connections code,\nwhich already treats JUST_WORKS/JUST_CFM as unauthenticated.","state":0,"publishedAt":"2026-05-01T14:15:01.277+00:00","modifiedAt":"2026-10-19T19:06:08.313+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/smp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"9a38659a3d06080715691bd3139f9c4b61f688e3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"667f44f1392df6482483756458c48670e579e9ff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"929db734d12db41ca5f95424db4612397f1bd4a7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"b1c6a8e554a39b222c0879a288ea98e338fc4d77\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"0afc846bd80073ffcd2b8040f2b2fafaea3d9f72\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"061ee71ac6b03c9f8432fe49538c3682bfcf4cf3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"9a6d0db176f082685e0b6149700c0baf3ce2aa8b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"fff3490f47810e2d34b91fb9e31103e923b11c2f\",\n                            \"lessThan\": \"20756fec2f0108cb88e815941f1ffff88dc286fe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"14ec593d6bb050cf40a4ade2f9ac9ca050e0412c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"3.15.5\",\n                            \"lessThan\": \"3.16\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/smp.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.134\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.81\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.22\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.12\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/9a38659a3d06080715691bd3139f9c4b61f688e3","https://git.kernel.org/stable/c/667f44f1392df6482483756458c48670e579e9ff","https://git.kernel.org/stable/c/929db734d12db41ca5f95424db4612397f1bd4a7","https://git.kernel.org/stable/c/b1c6a8e554a39b222c0879a288ea98e338fc4d77","https://git.kernel.org/stable/c/0afc846bd80073ffcd2b8040f2b2fafaea3d9f72","https://git.kernel.org/stable/c/061ee71ac6b03c9f8432fe49538c3682bfcf4cf3","https://git.kernel.org/stable/c/9a6d0db176f082685e0b6149700c0baf3ce2aa8b","https://git.kernel.org/stable/c/20756fec2f0108cb88e815941f1ffff88dc286fe"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-31773","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-31773","identifiers":["CVE-2026-31773"]},"retained":false,"historicalAffected":[]}],"coverage":[]}