Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2026-43020

Опубликовано: 01 мая 2026
Источник: redhat
CVSS3: 7.3
EPSS Низкий

Описание

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.

A flaw was found in the Linux kernel's Bluetooth management (MGMT) component. An attacker could exploit a vulnerability in how Long Term Keys (LTK) are loaded. By providing an oversized encryption size, a stack buffer overflow can occur, potentially leading to a denial of service.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Enterprise Linux 6kernelNot affected
Red Hat Enterprise Linux 7kernelAffected
Red Hat Enterprise Linux 7kernel-rtAffected
Red Hat Enterprise Linux 9kernel-rtAffected
Red Hat Enterprise Linux 10kernelFixedRHSA-2026:2155728.05.2026
Red Hat Enterprise Linux 8kernel-rtFixedRHSA-2026:2174528.05.2026
Red Hat Enterprise Linux 8kernelFixedRHSA-2026:2170628.05.2026
Red Hat Enterprise Linux 9kernelFixedRHSA-2026:2155628.05.2026
Red Hat Enterprise Linux 9kernelFixedRHSA-2026:2155628.05.2026

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-120
https://bugzilla.redhat.com/show_bug.cgi?id=2464455kernel: Bluetooth: MGMT: validate LTK enc_size on load

EPSS

Процентиль: 3%
0.00129
Низкий

7.3 High

CVSS3

Связанные уязвимости

CVSS3: 7.8
ubuntu
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.

CVSS3: 7.8
nvd
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.

CVSS3: 7.8
debian
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: B ...

CVSS3: 7.8
github
3 месяца назад

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.

CVSS3: 7.8
fstec
3 месяца назад

Уязвимость модуля net/bluetooth/mgmt.c ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 3%
0.00129
Низкий

7.3 High

CVSS3