High 8.1Published May 6, 2026

CVE-2026-43134Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

Updated under an hour ago (Oct 27, 2026, 5:20 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE.

CVSS: 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-326
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d before 335071c0c3637064ec250481f589075db44fe4e6; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d before fa6ad76fa8623c0a50d529cd5726fa5d819a3be4; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d before 9118601ff90b79e8df3c0c98f48ae00c1b02ecef; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d before 481ea39b342c347b6ac029f3d418486280be4e45; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d before ec91078e132179b04e0c3906b599816c056ceaad; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d before 96581749c7c14fbec32c35728520867929600041; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d builds before 8dd43f9a9323f9c01bc8246da8d81a4c783c9e97; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d before 138d7eca445ef37a0333425d269ee59900ca1104	CNA record
linux linux_kernel linux:linux_kernel	from 3.14 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 7.0	NVD

References

References

https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6	patch
https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4	patch
https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef	patch
https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45	patch
https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad	patch
https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041	patch
https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97	patch
https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.