01 Record

CVE-2025-39889

Bluetooth: l2cap: Check encryption key size on incoming connection

HighPUBLISHEDCNA: Linux

CNA base score8.1 CVSS v3.xCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

View raw JSON

02 Description

Bluetooth: l2cap: Check encryption key size on incoming connection

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.10% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 0.8% of scored records. A rank, not a probability.

NVD base score

5.5 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-06-17.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2025-09-24 11:02Z11 MO AGO

Last updated

2026-08-05 12:05Z1 MO AGO

Reserved

2025-04-16

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.1)

CNA CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-326Inadequate Encryption StrengthClass

Data version

5.2

Document digest

71506eda73e345d37254de9cdfa0c33a3ca2bc868eaf4c474e1a33e8528a610f

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux4f911a538e089cce808a15dc3277250f4f8daef9 to < ed503d340a501e414114ddc614a3aae4f6e9eae2, 288c06973daae4637f25a0d1bdaf65fdbf8455f9 to < 24b2cdfc16e9bd6ab3d03b8e01c590755bd3141f, 288c06973daae4637f25a0d1bdaf65fdbf8455f9 to < c6d527bbd3d3896375079f5dbc8b7f96734a3ba5, 288c06973daae4637f25a0d1bdaf65fdbf8455f9 to < 9e3114958d87ea88383cbbf38c89e04b8ea1bce5, 288c06973daae4637f25a0d1bdaf65fdbf8455f9 to < d49798ecd26e0ee7995a7fc1e90ca5cd9b4402d6, 288c06973daae4637f25a0d1bdaf65fdbf8455f9 to < d4ca2fd218caafbf50e3343ba1260c6a23b5676a, 288c06973daae4637f25a0d1bdaf65fdbf8455f9 to < 522e9ed157e3c21b4dd623c79967f72c21e45b78, 5.11—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/ed503d340a501e414114ddc614a3aae4f6e9eae2
git.kernel.orghttps://git.kernel.org/stable/c/24b2cdfc16e9bd6ab3d03b8e01c590755bd3141f
git.kernel.orghttps://git.kernel.org/stable/c/c6d527bbd3d3896375079f5dbc8b7f96734a3ba5
git.kernel.orghttps://git.kernel.org/stable/c/9e3114958d87ea88383cbbf38c89e04b8ea1bce5
git.kernel.orghttps://git.kernel.org/stable/c/d49798ecd26e0ee7995a7fc1e90ca5cd9b4402d6
git.kernel.orghttps://git.kernel.org/stable/c/d4ca2fd218caafbf50e3343ba1260c6a23b5676a
git.kernel.orghttps://git.kernel.org/stable/c/522e9ed157e3c21b4dd623c79967f72c21e45b78

01 Record index

CVE-2025-39889

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References

02 Records

CVE-2025-39889

02 Description

03 Exploitation and scoring

04 Metadata

05 Affected products

06 References