Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.
References (8)
Core 8
Core References
Scores
CVSS v3
7.8
EPSS
0.0013
EPSS Percentile
2.9%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-787
Status
published
Products (27)
linux/Kernel
3.4.0 - 5.10.253linux
linux/Kernel
5.11.0 - 5.15.203linux
linux/Kernel
5.16.0 - 6.1.168linux
linux/Kernel
6.13.0 - 6.18.22linux
linux/Kernel
6.19.0 - 6.19.12linux
linux/Kernel
6.2.0 - 6.6.134linux
linux/Kernel
6.7.0 - 6.12.81linux
Linux/Linux
< 3.4
Linux/Linux
3.4
Linux/Linux
346af67b8d116f01ef696fd47959a55deb2db8b6 - 0f37d1e65c6d71ad94ccfb5c602163c525db789d
... and 17 more
Published
May 01, 2026
Tracked Since
May 01, 2026