---
id: CVE-2026-43134
title: 'Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

  This adds a check for encryption key size upon receiving
  L2CAP_LE_CONN_REQ which is required by L2CA…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    335071c0c3637064ec250481f589075db44fe4e6
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    fa6ad76fa8623c0a50d529cd5726fa5d819a3be4
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    9118601ff90b79e8df3c0c98f48ae00c1b02ecef
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    481ea39b342c347b6ac029f3d418486280be4e45
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    ec91078e132179b04e0c3906b599816c056ceaad
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    96581749c7c14fbec32c35728520867929600041
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    8dd43f9a9323f9c01bc8246da8d81a4c783c9e97
  - >-
    Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d <
    138d7eca445ef37a0333425d269ee59900ca1104
  - Linux 3.14
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:15:03.252855Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:34.214Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43134'
references:
  - url: 'https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6'
  - url: 'https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4'
  - url: 'https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef'
  - url: 'https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45'
  - url: 'https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad'
  - url: 'https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041'
  - url: 'https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97'
  - url: 'https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104'
tags:
  - cve.org
epss: 0.00237
epssPercentile: 0.13702
ingestedAt: '2026-10-16T17:24:46.684Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ

This adds a check for encryption key size upon receiving
L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which
expects L2CAP_CR_LE_BAD_KEY_SIZE.

## Affected

- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < 335071c0c3637064ec250481f589075db44fe4e6`
- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < fa6ad76fa8623c0a50d529cd5726fa5d819a3be4`
- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < 9118601ff90b79e8df3c0c98f48ae00c1b02ecef`
- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < 481ea39b342c347b6ac029f3d418486280be4e45`
- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < ec91078e132179b04e0c3906b599816c056ceaad`
- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < 96581749c7c14fbec32c35728520867929600041`
- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < 8dd43f9a9323f9c01bc8246da8d81a4c783c9e97`
- `Linux >= 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d < 138d7eca445ef37a0333425d269ee59900ca1104`
- `Linux 3.14`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.