CVE-2026-43020

A flaw was found in the Linux kernel's Bluetooth management (MGMT) component. An attacker could exploit a vulnerability in how Long Term Keys (LTK) are loaded. By providing an oversized encryption size, a stack buffer overflow can occur, potentially leading to a denial of service.

Red Hat has rated this vulnerability as Moderate severity because exploitation requires local access with administrative privileges to manage Bluetooth interfaces. Typical Red Hat Enterprise Linux server and container environments do not enable Bluetooth controllers, substantially limiting exposure. While injecting a disproportionate key length during management operations triggers a stack-based memory overwrite that leads to a kernel crash, it cannot be executed by unauthenticated remote actors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.