CVE-2025-39889

What it actually does

The vulnerability permits incoming L2CAP Bluetooth connections when the encryption key size is smaller than the required 16 bytes for Security Mode 4 Level 4, allowing the stack to accept weak keys (1-15 bytes) without enforcing the minimum size check.

Why it matters to the business

Attackers within Bluetooth range can establish connections using reduced encryption strength on affected Linux systems, increasing the risk of data interception or manipulation and requiring urgent patching across kernel deployments to maintain secure wireless communications.

How an attack unfolds

An attacker initiates a Bluetooth pairing or connection request using a deliberately small encryption key size; the vulnerable L2CAP layer reads the key size via HCI but skips validation, responds with a successful connection, and proceeds with the insecure link, bypassing the intended security block.

How to fix it

Apply the kernel fix from commit 24b2cdfc16e9bd6ab3d03b8e01c590755bd3141f or later stable releases; for listed SUSE distributions update Mozilla Firefox packages to version 52.8.1esr-109.34.1 or newer where the Bluetooth stack change is included.

How to confirm the fix worked

Confirm the presence of the patch by checking kernel source for the added key-size validation in net/bluetooth/l2cap_core.c, or verify running kernel version against the fixed commit; test with PTS tool or custom Bluetooth client attempting sub-16-byte keys to ensure Connection Refused - Security block is returned.

Typical attack path

1. Position within Bluetooth radio range of the target system
2. Send crafted L2CAP Connection Request with PSM and small encryption key
3. Kernel performs Read Encryption Key Size HCI command and receives undersized key
4. L2CAP layer accepts the connection without checking against 16-byte minimum
5. Attacker establishes the link and begins traffic over the weakly encrypted channel

How to detect it

Review kernel logs and Bluetooth HCI traces for incoming L2CAP connections that succeed despite reported key sizes below 16 bytes; look for successful Connection Response messages following Read Encryption Key Size events indicating undersized keys.

What your security team should do

• Prioritize kernel updates on all systems exposing Bluetooth interfaces
• Disable Bluetooth when not required until patches are applied
• Monitor for upstream kernel releases containing the L2CAP encryption check
• Review Bluetooth security policies to enforce minimum key sizes post-update