CyberSecBulletin
CVE-2026-43134NVD status: Modified

Linux: Inadequate Encryption Strength

Published Updated By the CyberSecBulletin desk

CVE-2026-43134 is a high-severity inadequate encryption strength vulnerability in Linux, with a CVSS 3.1 base score of 8.1 out of 10. It can be exploited from the same local network by an unauthenticated attacker, without any action from a user. The record lists versions 335071c0c3637064ec250481f589075db44fe4e6, fa6ad76fa8623c0a50d529cd5726fa5d819a3be4, 9118601ff90b79e8df3c0c98f48ae00c1b02ecef as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 335071c0c3637064ec250481f589075db44fe4e6 or fa6ad76fa8623c0a50d529cd5726fa5d819a3be4 or 9118601ff90b79e8df3c0c98f48ae00c1b02ecef or 481ea39b342c347b6ac029f3d418486280be4e45, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.252 or 5.15.202 or 6.1.165 or 6.6.128, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, 335071c0c3637064ec250481f589075db44fe4e6; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, fa6ad76fa8623c0a50d529cd5726fa5d819a3be4; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, 9118601ff90b79e8df3c0c98f48ae00c1b02ecef; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, 481ea39b342c347b6ac029f3d418486280be4e45; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, ec91078e132179b04e0c3906b599816c056ceaad; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, 96581749c7c14fbec32c35728520867929600041; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, 8dd43f9a9323f9c01bc8246da8d81a4c783c9e97; 27e2d4c8d28be1d1b4ecfbffab572d7dbd35254d up to, but not including, 138d7eca445ef37a0333425d269ee59900ca1104; and 1 more ranges335071c0c3637064ec250481f589075db44fe4e6, fa6ad76fa8623c0a50d529cd5726fa5d819a3be4, 9118601ff90b79e8df3c0c98f48ae00c1b02ecef, 481ea39b342c347b6ac029f3d418486280be4e45, ec91078e132179b04e0c3906b599816c056ceaad, 96581749c7c14fbec32c35728520867929600041
LinuxLinux Kernel3.14 up to, but not including, 5.10.252; 5.11 up to, but not including, 5.15.202; 5.16 up to, but not including, 6.1.165; 6.2 up to, but not including, 6.6.128; 6.7 up to, but not including, 6.12.75; 6.13 up to, but not including, 6.18.16; 6.19 up to, but not including, 6.19.6; 7.05.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
AdjacentThe attacker must be on the same local network segment.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
NoneAvailability is not affected.

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix missing key size check for L2CAP_LE_CONN_REQ This adds a check for encryption key size upon receiving L2CAP_LE_CONN_REQ which is required by L2CAP/LE/CFC/BV-15-C which expects L2CAP_CR_LE_BAD_KEY_SIZE.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

How developers prevent this class of flaw

  • Use an encryption scheme that is currently considered to be strong by experts in the field.

More Inadequate Encryption Strength vulnerabilities (CWE-326)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Inadequate Encryption Strength vulnerabilities

Spotted an error? Tell us.