Security readout for executives and security teams
Plain-English summary
Linux systems using Bluetooth may accept an incoming L2CAP connection protected by an encryption key weaker than the required 16 bytes. A nearby unauthenticated attacker could potentially undermine confidentiality or integrity of Bluetooth communications. The issue does not indicate availability impact, and the supplied evidence does not establish real-world exploitation.
Executive priority
Treat as a high-priority endpoint and embedded-Linux update where Bluetooth is enabled, especially in public, shared, or physically accessible environments. It is less urgent for systems without usable Bluetooth. Confirm exposure promptly, then patch through supported vendor channels; current evidence does not justify an emergency response based on active exploitation.
Technical view
The Linux Bluetooth L2CAP responder failed to validate encryption-key size when Security Mode 4 Level 4 required a 16-byte key. Testing showed connections using shorter keys could succeed instead of being refused with a security-block response. CVSS 3.1 is 8.1: adjacent-network access, low complexity, no privileges or user interaction, with high confidentiality and integrity impact.
Likely exposure
Exposure is limited to Linux systems with affected kernels and relevant Bluetooth functionality enabled or reachable by nearby devices. The bundle identifies affected kernel releases beginning with 5.11 and lists several later branch versions, but does not provide complete range semantics. Distribution backports may change status, so kernel version alone is insufficient.
Exploitation context
The attacker must be within Bluetooth range, making this an adjacent-network rather than internet-scale threat. No privileges or user interaction are required according to the CVSS vector. The bundle states KEV is false and contains no evidence of active exploitation, public proof-of-concept availability, or observed attacks.
Researcher notes
The weakness maps to CWE-326: inadequate encryption strength. The observable defect is acceptance of an incoming L2CAP connection using a 1–15-byte key when 16 bytes are required. The supplied commit references indicate fixes across stable branches. Exact vulnerable ranges, distribution-specific backports, affected Bluetooth profiles, and practical attack outcomes are not fully established by the bundle.
Mitigation direction
- Install a vendor-supported kernel containing the applicable upstream or stable fix.
- Check distribution advisories because vendors may backport fixes without changing to the listed upstream version.
- Disable Bluetooth where it is unnecessary until affected systems can be updated.
- Prioritize exposed endpoints handling sensitive Bluetooth communications or operating in untrusted physical locations.
Validation and detection
- Inventory Linux kernel versions and identify systems with Bluetooth hardware or services enabled.
- Compare each distribution package against its vendor advisory and backport status.
- Confirm the installed kernel includes the applicable referenced stable commit or vendor-equivalent fix.
- After updating, verify short encryption keys are rejected when Security Mode 4 Level 4 is required.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-326: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-39889 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N2.85.2LinuxCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/ed503d340a501e414114ddc614a3aae4f6e9eae2CVE reference, Linux
- https://git.kernel.org/stable/c/24b2cdfc16e9bd6ab3d03b8e01c590755bd3141fCVE reference, Linux
- https://git.kernel.org/stable/c/c6d527bbd3d3896375079f5dbc8b7f96734a3ba5CVE reference, Linux
- https://git.kernel.org/stable/c/9e3114958d87ea88383cbbf38c89e04b8ea1bce5CVE reference, Linux
- https://git.kernel.org/stable/c/d49798ecd26e0ee7995a7fc1e90ca5cd9b4402d6CVE reference, Linux
- https://git.kernel.org/stable/c/d4ca2fd218caafbf50e3343ba1260c6a23b5676aCVE reference, Linux
- https://git.kernel.org/stable/c/522e9ed157e3c21b4dd623c79967f72c21e45b78CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Inadequate Encryption Strength
Inadequate Encryption Strength represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.