Bug 2468050 (CVE-2026-43334)

Summary: CVE-2026-43334 kernel: Bluetooth: SMP: force responder MITM requirements before building the pairing response
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's Bluetooth Security Manager Protocol (SMP). An attacker could exploit this vulnerability during the Bluetooth pairing process by manipulating authentication requirements. This could lead to the selection of a weaker pairing method than intended, potentially allowing a remote attacker to conduct a Man-in-the-Middle (MITM) attack and intercept or alter communications between paired devices.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-08 14:01:58 UTC 
In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SMP: force responder MITM requirements before building the pairing response

smp_cmd_pairing_req() currently builds the pairing response from the
initiator auth_req before enforcing the local BT_SECURITY_HIGH
requirement. If the initiator omits SMP_AUTH_MITM, the response can
also omit it even though the local side still requires MITM.

tk_request() then sees an auth value without SMP_AUTH_MITM and may
select JUST_CFM, making method selection inconsistent with the pairing
policy the responder already enforces.

When the local side requires HIGH security, first verify that MITM can
be achieved from the IO capabilities and then force SMP_AUTH_MITM in the
response in both rsp.auth_req and auth. This keeps the responder auth bits
and later method selection aligned.
Comment 1 Alexander B 2026-05-15 11:38:02 UTC 
Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-43334.mbox
Comment 4 errata-xmlrpc 2026-09-08 11:35:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:65334 https://access.redhat.com/errata/RHSA-2026:65334
Comment 5 Jon Orris 2026-09-14 13:35:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:67150 https://access.redhat.com/errata/RHSA-2026:67150
Comment 6 Jon Orris 2026-09-22 19:30:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:70403 https://access.redhat.com/errata/RHSA-2026:70403
Comment 7 Jon Orris 2026-09-22 20:21:01 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:70402 https://access.redhat.com/errata/RHSA-2026:70402