CVE-2026-43334 Bluetooth: SMP: force responder MITM requirements before building the pairing response
An attacker can bypass Bluetooth Secure Simple Pairing MITM protections by manipulating authentication requirements during the pairing process.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43334?
CVE-2026-43334 is a high-severity vulnerability in Linux kernel, published on 8 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SMP: force responder MITM requirements before building the pairing response
smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM.
tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces.
When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned.
Weakness: CWE-863
Which versions are affected by CVE-2026-43334?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43334?
Apply the vendor's patch.
Is CVE-2026-43334 being exploited?
There is no known exploitation of CVE-2026-43334 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43334, DEBIAN-CVE-2026-43334, GHSA-3ggx-x2j4-gfqr, ROOT-OS-DEBIAN-11-CVE-2026-43334, ROOT-OS-UBUNTU-2204-CVE-2026-43334, ROOT-OS-UBUNTU-2404-CVE-2026-43334 and 1 more.