CVE-2026-43134: Linux Kernel Privilege Escalation Flaw

CVE-2026-43134 Overview

CVE-2026-43134 is a Linux kernel vulnerability in the Bluetooth Logical Link Control and Adaptation Protocol (L2CAP) implementation. The flaw stems from a missing encryption key size check when the kernel handles incoming L2CAP_LE_CONN_REQ packets on Bluetooth Low Energy (LE) connections. The Bluetooth specification's L2CAP/LE/CFC/BV-15-C test case requires the stack to return L2CAP_CR_LE_BAD_KEY_SIZE when a peer attempts to establish an LE Credit Based Flow Control channel using an insufficient key size, but the affected kernel code did not enforce this validation.

Critical Impact
Missing key size enforcement on LE L2CAP connections allows peer devices to negotiate channels protected by encryption keys weaker than the local policy requires, undermining Bluetooth confidentiality guarantees.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/l2cap_core.c)
Linux distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Devices using kernel-mode Bluetooth LE with L2CAP Credit Based Flow Control channels

Discovery Timeline

2026-05-06 - CVE-2026-43134 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43134

Vulnerability Analysis

The vulnerability resides in the Linux kernel Bluetooth L2CAP layer, specifically in the handler for L2CAP_LE_CONN_REQ connection request packets used by LE Credit Based Flow Control (CBFC) channels. When a remote peer requests a new LE L2CAP channel, the local stack must validate that the underlying SMP-derived encryption key meets the minimum size required by local policy. The vulnerable code path proceeds with channel setup without performing this validation.

As a result, the kernel never returns the protocol-defined L2CAP_CR_LE_BAD_KEY_SIZE response code, even when the link encryption key is shorter than the configured minimum. The Bluetooth qualification test L2CAP/LE/CFC/BV-15-C explicitly verifies this behavior, and the patched implementation now satisfies that requirement.

Root Cause

The root cause is missing input and state validation in the LE L2CAP connection request handler [CWE-20]. Existing key size checks were already implemented for BR/EDR L2CAP connections, but the equivalent enforcement was absent on the LE path. The fix introduces a key size comparison against the channel's required encryption key size and returns the appropriate L2CAP_CR_LE_BAD_KEY_SIZE response when the negotiated key is too small.

Attack Vector

Exploitation requires Bluetooth LE proximity to the target and the ability to complete LE pairing with a downgraded or attacker-controlled key size. A malicious peer that successfully negotiates a short encryption key can then open LE L2CAP CBFC channels that the local stack would otherwise reject. This weakens the cryptographic protection of higher-layer protocols carried over those channels, including profile data and application traffic. The vulnerability is not remotely reachable over IP networks and requires radio-range adjacency.

The fix is distributed across multiple stable branches in commits including 138d7eca, 335071c0, 481ea39b, 8dd43f9a, 9118601f, 96581749, ec91078e, and fa6ad76f. See the Linux kernel stable tree for the patch content.

Detection Methods for CVE-2026-43134

Indicators of Compromise

Unexpected LE L2CAP CBFC channel establishments from unknown Bluetooth peers in hci traces
Bluetooth pairings completed with encryption key sizes below organizational policy (for example, less than 16 bytes)
Kernel running a Bluetooth-enabled build whose version predates the stable commits referenced above

Detection Strategies

Inventory Linux endpoints and servers running Bluetooth-capable kernels and compare versions against patched stable releases
Capture and review HCI snoop logs (btmon, hcidump) for LE Connection Parameter Request and L2CAP connection responses that omit L2CAP_CR_LE_BAD_KEY_SIZE rejections under low-key-size conditions
Use configuration management tooling to verify that bluetoothd and kernel modules bluetooth.ko and dependent drivers are at patched versions

Monitoring Recommendations

Forward kernel and bluetoothd logs to a centralized log platform and alert on Bluetooth pairing or channel events on systems where Bluetooth should be disabled
Track kernel package versions across the fleet and flag hosts that have not received the stable update referenced by the kernel.org commits
Monitor for unauthorized loading of Bluetooth kernel modules on servers and fixed-function appliances

How to Mitigate CVE-2026-43134

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution that includes the referenced fix commits
Disable the Bluetooth stack (systemctl disable --now bluetooth and unload bluetooth kernel modules) on systems that do not require Bluetooth connectivity
Enforce a minimum encryption key size of 16 bytes in bluetoothd configuration for systems that must keep Bluetooth enabled

Patch Information

The fix adds a key size validation step to the L2CAP_LE_CONN_REQ handler so that channels protected by an insufficient key size are rejected with L2CAP_CR_LE_BAD_KEY_SIZE. Patched commits are available in the Linux stable tree, including commit 138d7eca, commit 335071c0, commit 481ea39b, commit 8dd43f9a, commit 9118601f, commit 96581749, commit ec91078e, and commit fa6ad76f. Consume the fix through your distribution's kernel package update channel.

Workarounds

Disable Bluetooth entirely on systems without an operational requirement for it by blacklisting the bluetooth and btusb kernel modules
Restrict Bluetooth pairing to trusted devices and require Secure Connections with maximum key size in bluetoothd policy
Physically remove or disable Bluetooth radios on fixed-function and server hardware where feasible

bash

# Configuration example: blacklist Bluetooth kernel modules
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb'     | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth
sudo modprobe -r btusb bluetooth