Security readout for executives and security teams
Plain-English summary
Linux can mistakenly mark a Bluetooth pairing key as authenticated when legacy Just Works or Confirm pairing provided no man-in-the-middle protection. Later access controls may therefore trust a weaker connection than intended. The CVSS score is 8.8, although exposure requires Bluetooth proximity and the affected legacy responder path.
Executive priority
Treat this as a high-severity patching priority for Bluetooth-enabled Linux systems permitting legacy pairing. Urgency is lower after confirming Bluetooth or the affected path is unavailable. Current evidence does not justify treating it as an actively exploited emergency.
Technical view
In smp_random(), the legacy responder derived STK authentication metadata from the requested security level instead of the pairing flow's achieved MITM state. Consequently, Just Works or Confirm pairing could store an unauthenticated STK as authenticated. The referenced stable-kernel changes use the established MITM state, aligning this path with Secure Connections behavior.
Likely exposure
Most relevant to Linux systems with Bluetooth enabled that act as responders, permit legacy pairing, and use authenticated-key status to protect sensitive services. The supplied version data is ambiguous, so determine exact exposure through distributor guidance and presence of the referenced stable fixes.
Exploitation context
The CVSS vector specifies adjacent access, low complexity, no privileges, and no user interaction. The bundle provides no evidence of public exploitation or observed attacks, and KEV is false. Practical abuse would require Bluetooth proximity plus the affected legacy pairing and authorization conditions.
Researcher notes
This is an authentication-state mismatch, not a described memory-safety defect. Assess whether legacy responder pairing is reachable and which authorization paths consume the authenticated-key flag. The supplied version arrays are insufficiently clear for reliable range mapping; validate exposure by stable commit or distributor bulletin.
Mitigation direction
- Apply a vendor-supported kernel update incorporating the applicable referenced stable fix.
- Consult the Linux distributor for exact fixed-version and backport information.
- Prioritize remediation where legacy Bluetooth pairing protects sensitive services.
Validation and detection
- Inventory kernel versions and identify systems with Bluetooth enabled.
- Determine whether systems accept legacy responder Just Works or Confirm pairing.
- Check vendor builds for the applicable referenced stable commit or documented backport.
- Verify in an authorized lab that resulting STKs remain marked unauthenticated.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-31773 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
8.8HighVector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9a38659a3d06080715691bd3139f9c4b61f688e3CVE reference, Linux
- https://git.kernel.org/stable/c/667f44f1392df6482483756458c48670e579e9ffCVE reference, Linux
- https://git.kernel.org/stable/c/929db734d12db41ca5f95424db4612397f1bd4a7CVE reference, Linux
- https://git.kernel.org/stable/c/b1c6a8e554a39b222c0879a288ea98e338fc4d77CVE reference, Linux
- https://git.kernel.org/stable/c/0afc846bd80073ffcd2b8040f2b2fafaea3d9f72CVE reference, Linux
- https://git.kernel.org/stable/c/061ee71ac6b03c9f8432fe49538c3682bfcf4cf3CVE reference, Linux
- https://git.kernel.org/stable/c/9a6d0db176f082685e0b6149700c0baf3ce2aa8bCVE reference, Linux
- https://git.kernel.org/stable/c/20756fec2f0108cb88e815941f1ffff88dc286feCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.