CVE-2025-39889 addresses a vulnerability in the Linux kernel's Bluetooth L2CAP component that failed to enforce proper encryption key size validation for incoming connections. This flaw allowed connections with insufficient key sizes (1-15 bytes) to succeed, bypassing the required 16-byte minimum for Security Mode 4 Level 4. Rated Medium severity (CVSS 5.5), the vulnerability has a high availability impact (A:H) and requires local access with low privileges for exploitation, stemming from inadequate encryption strength (CWE-326). There is currently no evidence of active exploitation, public exploit code, or inclusion in CISA's Known Exploited Vulnerabilities catalog. Community discussion and media coverage are minimal, indicating limited current threat activity.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.11, < 5.15.181CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 5.16, < 6.1.135CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.2, < 6.6.88CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.7, < 6.12.25CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 6.13, < 6.14.4CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Linux kernel (Azure) vulnerabilities
Mar 25, 2026Linux kernel (Azure FIPS) vulnerabilities
Mar 4, 2026Linux kernel (Azure) vulnerabilities
Mar 4, 2026Linux kernel (Xilinx) vulnerabilities
Feb 24, 2026Linux kernel (IBM) vulnerabilities
Feb 24, 2026kernel: Bluetooth: l2cap: Check encryption key size on incoming connection
Sep 24, 2025