NetSight
IP …
high7.8

CVE-2026-43020

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided…

Impact

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: validate LTK enc_size on load Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer. Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 3.4 before 5.10.253
from 5.11 before 5.15.203
from 5.16 before 6.1.168
from 6.2 before 6.6.134
from 6.7 before 6.12.81
from 6.13 before 6.18.22

Weakness classification

CWE-787

References