Bluetooth Encryption Key Size Vulnerability in Linux Kernel by Vencer Co., Ltd.

CVE-2025-39889

What is CVE-2025-39889?

A vulnerability exists in the Bluetooth stack of the Linux kernel, where an improper check of the encryption key size allows connections with insufficient security. Specifically, the system fails to validate the key size on incoming connection requests, which should comply with Security Mode 4 Level 4 that mandates a 16-byte key size. This oversight may allow devices with weaker encryption to establish a connection, undermining the intended security requirements and potentially exposing sensitive data.

References