CVE-2026-31773 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Bluetooth SMP implementation users and deployers, Security teams responsible for Linux kernel and Bluetooth SMP implementation security, operators of Linux-based systems, and platform administrators responsible for vulnerability management and security configurations.

Why it matters

A vulnerability in the Linux kernel's Bluetooth SMP implementation could allow an attacker to derive an unauthenticated legacy responder STK, potentially leading to security issues. Linux kernel developers and maintainers, Bluetooth SMP implementation users and deployers, and security teams should assess exposure and verify patch levels.

• Verify Bluetooth SMP implementation security configurations and patch levels.
• Assess potential security risks related to unauthenticated legacy responder STK.
• Review and apply patches to ensure correct MITM authentication handling.
• Monitor for potential security issues related to Bluetooth SMP authentication.

Technical summary

The Linux kernel's Bluetooth SMP implementation incorrectly labels the stored STK as authenticated when the local service requested high security but the pairing flow did not achieve MITM authentication. This could potentially lead to security issues. The vulnerability affects Linux kernel versions prior to the fixed commits. To address this, developers should review and apply patches to ensure correct MITM authentication handling. The incorrect labeling of STK as authenticated can lead to security risks if not properly addressed.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided patch commits to ensure the Bluetooth SMP implementation is correctly handling MITM authentication.
• Verify the Linux kernel version and update to a fixed version if necessary.
• Monitor for potential security issues related to Bluetooth SMP authentication.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and fixed commits. However, there is limited information on potential exploits or attacks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.