CVE-2026-43020

HighCVSS 7.8/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: MGMT: validate LTK enc_size on load

Load Long Term Keys stores the user-provided enc_size and later uses it to size fixed-size stack operations when replying to LE LTK requests. An enc_size larger than the 16-byte key buffer can therefore overflow the reply stack buffer.

Reject oversized enc_size values while validating the management LTK record so invalid keys never reach the stored key state.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
LinuxLinux>= 346af67b8d116f01ef696fd47959a55deb2db8b6, < 0f37d1e65c6d71ad94ccfb5c602163c525db789d; >= 346af67b8d116f01ef696fd47959a55deb2db8b6, < 257cdb960d8ff6d60bb6461b03c814b6cf0c9e64; >= 346af67b8d116f01ef696fd47959a55deb2db8b6, < c34577f517b556fb6ca173d45bf7e766ae2564ce; >= 346af67b8d116f01ef696fd47959a55deb2db8b6, < f71695e81f4cb428f3c7e2138eae88199005b52c; >= 346af67b8d116f01ef696fd47959a55deb2db8b6, < 82f342b3b006ca1d65f4890c05f2ec32fcb808b6; >= 346af67b8d116f01ef696fd47959a55deb2db8b6, < 50fb64defa72a3fecd0af1ca7c6b47b5c5c2b257; >= 346af67b8d116f01ef696fd47959a55deb2db8b6, < 40ba329e8b4cd2fb11b0caf5e6a543ceaebb6009; >= 346af67b8d116f01ef696fd47959a55deb2db8b6, < b8dbe9648d69059cfe3a28917bfbf7e61efd7f15
LinuxLinux3.4

References

Timeline

Published
May 1, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-430215.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails WhenCVE-2026-430225.5In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if existsCVE-2026-430237.8In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: fix race conditions in sco_sock_connect() sco_sock_conCVE-2026-430245.5In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject immediate NF_QUEUE verdict nft_queue is aCVE-2026-430257.3In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use tCVE-2026-430265.5In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absentCVE-2026-430277.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_helper: pass helper to expect cleanup nf_conntCVE-2026-430287.1In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: ensure names are nul-terminated Reject names thatCVE-2026-430297.5In the Linux kernel, the following vulnerability has been resolved: mptcp: fix soft lockup in mptcp_recvmsg() syzbot reported a soft lockuCVE-2026-43036.4The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wsm_showDaCVE-2026-430307.8In the Linux kernel, the following vulnerability has been resolved: bpf: Fix regsafe() for pointers to packet In case rold->reg->range == CVE-2026-430317.5In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Fix BQL accounting for multi-BD TX packets When
CVE-2026-43020: High severity, CVSS 7.8 | Vulnix