Vulnerability in Linux kernel (CVE-2026-31773, CVSS 8.8)

Summary

Vulnerability in Linux kernel (CVE-2026-31773). Successful exploitation can lead to full system takeover.

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SMP: derive legacy responder STK authentication from MITM state

The legacy responder path in smp_random() currently labels the stored
STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.
That reflects what the local service requested, not what the pairing
flow actually achieved.

For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear
and the resulting STK should remain unauthenticated even if the local
side requested HIGH security. Use the established MITM state when
storing the responder STK so the key metadata matches the pairing result.

This also keeps the legacy path aligned with the Secure Connections code,
which already treats JUST_WORKS/JUST_CFM as unauthenticated.

Source: NIST National Vulnerability Database NVD

AI summary

Written by an external AI model and may contain mistakes. Check the original description and references below before acting on it.

LinuxカーネルにおけるBluetooth SMPの脆弱性が修正されました。この脆弱性は、ペアリングプロセスが実際に達成した認証結果を反映せず、STK認証を誤って管理する問題に関連しています。攻撃者による中間者攻撃を考慮せず、HIGHセキュリティが要求されても適切に反映されない可能性がありました。

❓ What is the problem

LinuxカーネルのBluetooth SMPにおけるSTK認証管理の問題

📍 Affected scope

Linuxカーネルのsmp_random()関数

🔥 Severity

認証の誤管理により、中間者攻撃に対して脆弱になる可能性があります。

🔧 How to fix

認証状態をペアリング結果に基づいて設定するように修正されています。

🛡️ Workaround

情報なし

🔍 Detection

影響を受けるカーネルバージョンのBluetooth STK認証管理を確認する。

Affected packages

Linux Kernel

[{"type":"ECOSYSTEM","events":[{"introduced":"3.16.0"},{"fixed":"5.10.253"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.203"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.168"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.134"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.81"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.22"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.12"}]}]

Fix status by distribution

Fixed packages published by each distribution for this CVE

BellSoft Alpaquita BELL-CVE-2026-31773 linux-lts Fixed in: 6.1.168-r0
Debian DEBIAN-CVE-2026-31773 linux Fixed in: 5.10.257-1
Ubuntu UBUNTU-CVE-2026-31773 linux

Summary

Original description

AI summary

Affected packages

Fix status by distribution

References