CVE-2026-31773

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: SMP: derive legacy responder STK authentication from MITM state<br /> <br /> The legacy responder path in smp_random() currently labels the stored<br /> STK as authenticated whenever pending_sec_level is BT_SECURITY_HIGH.<br /> That reflects what the local service requested, not what the pairing<br /> flow actually achieved.<br /> <br /> For Just Works/Confirm legacy pairing, SMP_FLAG_MITM_AUTH stays clear<br /> and the resulting STK should remain unauthenticated even if the local<br /> side requested HIGH security. Use the established MITM state when<br /> storing the responder STK so the key metadata matches the pairing result.<br /> <br /> This also keeps the legacy path aligned with the Secure Connections code,<br /> which already treats JUST_WORKS/JUST_CFM as unauthenticated.