{"id":"ASB-A-446114623", "published":"2026-06-01T00:00:00Z", "modified":"2026-06-26T15:22:10.377767615Z", "aliases":["CVE-2026-0097", "A-446114623"], "details":"In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"17-next:0"}, {"fixed":"17-next:2026-06-01"}]}], "versions":["17-next"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b9ddeb3bc5b0524090266d3b7a46e36358ff889e", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e9d39624fdb8f7bda9a780ca8b5856ff6f536da8", "https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224"], "severity":"Critical", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"31734972081692157849199047156492603822", "length":680}, "id":"ASB-A-446114623-10c44270", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b9ddeb3bc5b0524090266d3b7a46e36358ff889e", "target":{"file":"system/btif/src/btif_dm.cc", "function":"btif_dm_ble_passkey_notif_evt"}}, {"deprecated":false, "digest":{"function_hash":"231539311707053842326511678580377737895", "length":2666}, "id":"ASB-A-446114623-1ca21a99", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_pairing_timeout"}}, {"deprecated":false, "digest":{"function_hash":"234584975023575567124225679617481991260", "length":710}, "id":"ASB-A-446114623-2977a00d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/stack/smp/smp_keys.cc", "function":"smp_process_stk"}}, {"deprecated":false, "digest":{"line_hashes":["3625691933843217250556620466896161754", "180460862847800584050075945480277025953", "60906836200268158500077632011699044505", "95116370380363773146327872268626679668", "126424637657785920007779609142351287401", "21130100456077764852675937240907601578", "128977395532420042989448656985969031907", "119005825486589151620228838390581756434"], "threshold":0.9}, "id":"ASB-A-446114623-3b4a3a3e", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e9d39624fdb8f7bda9a780ca8b5856ff6f536da8", "target":{"file":"system/stack/smp/smp_api.cc"}}, {"deprecated":false, "digest":{"function_hash":"178127102311926419308237471210881399138", "length":1579}, "id":"ASB-A-446114623-4116de9e", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e9d39624fdb8f7bda9a780ca8b5856ff6f536da8", "target":{"file":"system/stack/smp/smp_api.cc", "function":"SMP_SecurityGrant"}}, {"deprecated":false, "digest":{"line_hashes":["81289191322123501918693501470100654319", "157475216257162784765266611508645658432", "9528417970154818471656132109669991909", "256054285687791892655556784859762617024"], "threshold":0.9}, "id":"ASB-A-446114623-41370136", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "target":{"file":"system/stack/smp/smp_int.h"}}, {"deprecated":false, "digest":{"line_hashes":["176717285701819479575032958130622517461", "183867214066230886505576089332383521001", "41433721140392426110811497754412979388", "306843216174972339125173593424615879353", "78603013078133253516786784461542205628"], "threshold":0.9}, "id":"ASB-A-446114623-662519e5", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/stack/smp/smp_api.cc"}}, {"deprecated":false, "digest":{"function_hash":"55862323285872360375307587000722879881", "length":3379}, "id":"ASB-A-446114623-73abf38d", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_pairing_timeout"}}, {"deprecated":false, "digest":{"line_hashes":["38123835087497506484898633376779262492", "254790785712942926675871187920411883863", "223887958365421081987998159018457054059", "263430309604587523823369773698866156173", "318418757775532371117983830244437272984"], "threshold":0.9}, "id":"ASB-A-446114623-84420aa4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"220425171157758378926929497308020213986", "length":320}, "id":"ASB-A-446114623-85109113", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "target":{"file":"system/stack/smp/smp_keys.cc", "function":"smp_process_stk"}}, {"deprecated":false, "digest":{"line_hashes":["319833472986775829743677446996955382289", "3316350120524910748598461943721072516", "235345597798508756032276339457177731212", "66710247988572523415490192681488114803", "60507341712601419771865639621180994164", "13150143018615496608642770297194703929", "282566932100429070970868609771770702982", "239369793877934887817650693000340810966"], "threshold":0.9}, "id":"ASB-A-446114623-8be4b687", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "target":{"file":"system/stack/smp/smp_api.cc"}}, {"deprecated":false, "digest":{"line_hashes":["177807944642272413518101036077138371059", "161230592689213163205596357226198968735", "15005705251139855933323253498756152745", "44320203957621936696434678523822654905", "189072722545604653230978890036628374192", "10247023671915606298415406766517976857", "38277492957114325423142317886662723033"], "threshold":0.9}, "id":"ASB-A-446114623-8dd53bee", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/btif/src/btif_dm.cc"}}, {"deprecated":false, "digest":{"line_hashes":["6662333090292325639705760121640365949", "275834036348265339710929929918284404990", "231748124881927304473764699746886958996", "330672095353401331477333315344355919999"], "threshold":0.9}, "id":"ASB-A-446114623-8df5f244", "match_only_versions":["17-next"], "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b9ddeb3bc5b0524090266d3b7a46e36358ff889e", "target":{"file":"system/btif/src/btif_dm.cc"}}, {"deprecated":false, "digest":{"function_hash":"116939169766352508570621063001681865988", "length":2629}, "id":"ASB-A-446114623-a26321f8", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/stack/smp/smp_api.cc", "function":"SMP_SecurityGrant"}}, {"deprecated":false, "digest":{"function_hash":"202124529917796476119499478848220356455", "length":1808}, "id":"ASB-A-446114623-acddd301", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "target":{"file":"system/stack/smp/smp_api.cc", "function":"SMP_SecurityGrant"}}, {"deprecated":false, "digest":{"line_hashes":["63927108321931861945040975026369331317", "331514989418353646555124812436198120819", "29961770108354421273276141488602969927", "81802989289701521345885942475963581843", "100727786838966863813576275650918830927", "309040050757110665077071123080589396815", "2047050416960220282334025273769055592", "71863587375596532448641087288144943144", "116368429212860701117145866034827547462", "215076257516853364270042412709744929827", "27000083482802005177720939971482819847", "135824465954853681109745544097732915916", "284463877033300790443222191866180354240", "126233690925395534068000546720249108983"], "threshold":0.9}, "id":"ASB-A-446114623-bddd67af", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "target":{"file":"system/stack/smp/smp_keys.cc"}}, {"deprecated":false, "digest":{"line_hashes":["165723551067596443627808594304837698616", "87551786920624643770589866637267990936", "331766078323403503447195387202510417066", "334088656154150803903442778856221267703", "246255422494265798244045827076173231416", "33125095065345972998658848534839993146"], "threshold":0.9}, "id":"ASB-A-446114623-e79c8937", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/stack/smp/smp_keys.cc"}}, {"deprecated":false, "digest":{"line_hashes":["131189704953720414700138846275303697508", "172308218576201221864339180023870634679", "61145065902019251150511510746572720178", "148192652637064108730146086683936079856", "266999473375592183526936122039934851709", "325924926307398868438743302400438361036", "137117731029949151760955524973005929415", "161116765934229210130791376889146676151", "111877256210062223587578662931793003140"], "threshold":0.9}, "id":"ASB-A-446114623-ef6a8d42", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"204047544868580953062332776951667461810", "length":1234}, "id":"ASB-A-446114623-f72774ef", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224", "target":{"file":"system/btif/src/btif_dm.cc", "function":"btif_dm_ble_passkey_notif_evt"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"15:0"}, {"fixed":"15:2026-06-01"}]}], "versions":["15"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344"], "severity":"Critical", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["100727786838966863813576275650918830927", "309040050757110665077071123080589396815", "2047050416960220282334025273769055592", "71863587375596532448641087288144943144", "116368429212860701117145866034827547462", "215076257516853364270042412709744929827", "27000083482802005177720939971482819847", "135824465954853681109745544097732915916", "284463877033300790443222191866180354240", "126233690925395534068000546720249108983"], "threshold":0.9}, "id":"ASB-A-446114623-314f4e78", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/stack/smp/smp_keys.cc"}}, {"deprecated":false, "digest":{"line_hashes":["192065062710062481221664505451915246086", "75660366820069275857519294038522055423", "234649847864776965351644763574326793960", "2375529922056744463974337151852461423", "325924926307398868438743302400438361036", "137117731029949151760955524973005929415", "161116765934229210130791376889146676151", "111877256210062223587578662931793003140"], "threshold":0.9}, "id":"ASB-A-446114623-372c80ca", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"314876946116844382721454981892951665404", "length":1575}, "id":"ASB-A-446114623-5a3f94b9", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/stack/smp/smp_api.cc", "function":"SMP_SecurityGrant"}}, {"deprecated":false, "digest":{"line_hashes":["81289191322123501918693501470100654319", "157475216257162784765266611508645658432", "9528417970154818471656132109669991909", "256054285687791892655556784859762617024"], "threshold":0.9}, "id":"ASB-A-446114623-5f68363c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/stack/smp/smp_int.h"}}, {"deprecated":false, "digest":{"line_hashes":["163429631773481684112422635745762218395", "3625691933843217250556620466896161754", "180460862847800584050075945480277025953", "60906836200268158500077632011699044505", "95116370380363773146327872268626679668"], "threshold":0.9}, "id":"ASB-A-446114623-9120966f", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/stack/smp/smp_api.cc"}}, {"deprecated":false, "digest":{"function_hash":"220425171157758378926929497308020213986", "length":320}, "id":"ASB-A-446114623-9eb5df08", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/stack/smp/smp_keys.cc", "function":"smp_process_stk"}}, {"deprecated":false, "digest":{"function_hash":"236880810580940641098025881300735569965", "length":2519}, "id":"ASB-A-446114623-a31626cc", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_pairing_timeout"}}, {"deprecated":false, "digest":{"line_hashes":["233260924195383638897797672176275277200", "172612379833823802265443814632088662762", "199586038176990265549444358813591772090"], "threshold":0.9}, "id":"ASB-A-446114623-a97c9e80", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/btif/src/btif_dm.cc"}}, {"deprecated":false, "digest":{"function_hash":"206777208765807015065849958471970014392", "length":611}, "id":"ASB-A-446114623-f042f615", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344", "target":{"file":"system/btif/src/btif_dm.cc", "function":"btif_dm_ble_key_notif_evt"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16:0"}, {"fixed":"16:2026-06-01"}]}], "versions":["16"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c"], "severity":"Critical", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"220425171157758378926929497308020213986", "length":320}, "id":"ASB-A-446114623-08f82c64", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/stack/smp/smp_keys.cc", "function":"smp_process_stk"}}, {"deprecated":false, "digest":{"line_hashes":["163429631773481684112422635745762218395", "3625691933843217250556620466896161754", "180460862847800584050075945480277025953", "60906836200268158500077632011699044505", "95116370380363773146327872268626679668"], "threshold":0.9}, "id":"ASB-A-446114623-244e4094", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/stack/smp/smp_api.cc"}}, {"deprecated":false, "digest":{"function_hash":"178127102311926419308237471210881399138", "length":1579}, "id":"ASB-A-446114623-282a457c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/stack/smp/smp_api.cc", "function":"SMP_SecurityGrant"}}, {"deprecated":false, "digest":{"line_hashes":["100727786838966863813576275650918830927", "309040050757110665077071123080589396815", "2047050416960220282334025273769055592", "71863587375596532448641087288144943144", "116368429212860701117145866034827547462", "215076257516853364270042412709744929827", "27000083482802005177720939971482819847", "135824465954853681109745544097732915916", "284463877033300790443222191866180354240", "126233690925395534068000546720249108983"], "threshold":0.9}, "id":"ASB-A-446114623-2d514286", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/stack/smp/smp_keys.cc"}}, {"deprecated":false, "digest":{"function_hash":"248487572407036750071956541583036296578", "length":738}, "id":"ASB-A-446114623-31c3772a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/btif/src/btif_dm.cc", "function":"btif_dm_ble_passkey_notif_evt"}}, {"deprecated":false, "digest":{"function_hash":"136896882482676993986616802680019165303", "length":2536}, "id":"ASB-A-446114623-39fc0778", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_pairing_timeout"}}, {"deprecated":false, "digest":{"line_hashes":["215434611870533229139651467995049986759", "317427715601974402403106861030012927387", "58814568334906160247402704404540062528", "93923946034019918841435357079851949038", "325924926307398868438743302400438361036", "137117731029949151760955524973005929415", "161116765934229210130791376889146676151", "111877256210062223587578662931793003140"], "threshold":0.9}, "id":"ASB-A-446114623-4cf173a8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"line_hashes":["81289191322123501918693501470100654319", "157475216257162784765266611508645658432", "9528417970154818471656132109669991909", "256054285687791892655556784859762617024"], "threshold":0.9}, "id":"ASB-A-446114623-d4771294", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c", "target":{"file":"system/stack/smp/smp_int.h"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"16-qpr2:0"}, {"fixed":"16-qpr2:2026-06-01"}]}], "versions":["16-qpr2"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2"], "severity":"Critical", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"31734972081692157849199047156492603822", "length":680}, "id":"ASB-A-446114623-06a1c855", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/btif/src/btif_dm.cc", "function":"btif_dm_ble_passkey_notif_evt"}}, {"deprecated":false, "digest":{"function_hash":"198837673737033526891854708781511167648", "length":2591}, "id":"ASB-A-446114623-0757b837", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_pairing_timeout"}}, {"deprecated":false, "digest":{"line_hashes":["100727786838966863813576275650918830927", "309040050757110665077071123080589396815", "2047050416960220282334025273769055592", "71863587375596532448641087288144943144", "116368429212860701117145866034827547462", "215076257516853364270042412709744929827", "27000083482802005177720939971482819847", "135824465954853681109745544097732915916", "284463877033300790443222191866180354240", "126233690925395534068000546720249108983"], "threshold":0.9}, "id":"ASB-A-446114623-643f02b8", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/stack/smp/smp_keys.cc"}}, {"deprecated":false, "digest":{"line_hashes":["81289191322123501918693501470100654319", "157475216257162784765266611508645658432", "9528417970154818471656132109669991909", "256054285687791892655556784859762617024"], "threshold":0.9}, "id":"ASB-A-446114623-76dba9f7", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/stack/smp/smp_int.h"}}, {"deprecated":false, "digest":{"line_hashes":["61392910550406673329496298584258038198", "105151585332266021873448458193517055170", "334990437324974967718856186551672711342", "218668422234596544083680269256485840524", "325924926307398868438743302400438361036", "137117731029949151760955524973005929415", "161116765934229210130791376889146676151", "111877256210062223587578662931793003140"], "threshold":0.9}, "id":"ASB-A-446114623-9bc2ba6c", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"function_hash":"220425171157758378926929497308020213986", "length":320}, "id":"ASB-A-446114623-f55a5ca6", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/stack/smp/smp_keys.cc", "function":"smp_process_stk"}}, {"deprecated":false, "digest":{"function_hash":"178127102311926419308237471210881399138", "length":1579}, "id":"ASB-A-446114623-f87c1aa0", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/stack/smp/smp_api.cc", "function":"SMP_SecurityGrant"}}, {"deprecated":false, "digest":{"line_hashes":["163429631773481684112422635745762218395", "3625691933843217250556620466896161754", "180460862847800584050075945480277025953", "60906836200268158500077632011699044505", "95116370380363773146327872268626679668"], "threshold":0.9}, "id":"ASB-A-446114623-fe95ca27", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2", "target":{"file":"system/stack/smp/smp_api.cc"}}]}}, {"package":{"name":"platform/packages/modules/Bluetooth", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"14:0"}, {"fixed":"14:2026-06-01"}]}], "versions":["14"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f"], "severity":"Critical", "spl":"2026-06-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["234719483917216146078890080887568829021", "244911249944050699601342375503221514997", "50815485918381838781077638954734192642", "12507181900325330289869155436419730122", "95709158769283428854514457943451189248", "180575503535316698369877424374383183662", "315777261998179110024032758772761492098", "184885794012164712733211957678767566916"], "threshold":0.9}, "id":"ASB-A-446114623-31ed95e6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/stack/btm/btm_sec.cc"}}, {"deprecated":false, "digest":{"line_hashes":["81289191322123501918693501470100654319", "45073608089931919213021578125757594783", "160935896494014157170542715010012818982", "269525516974204383321594965464893080229"], "threshold":0.9}, "id":"ASB-A-446114623-8c5d57b2", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/stack/smp/smp_int.h"}}, {"deprecated":false, "digest":{"function_hash":"322084882805485810986258917765237919250", "length":300}, "id":"ASB-A-446114623-b6c6d35a", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/stack/smp/smp_keys.cc", "function":"smp_process_stk"}}, {"deprecated":false, "digest":{"function_hash":"282368559494276747258425239610552102508", "length":775}, "id":"ASB-A-446114623-ca8006e4", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/btif/src/btif_dm.cc", "function":"btif_dm_ble_key_notif_evt"}}, {"deprecated":false, "digest":{"line_hashes":["163429631773481684112422635745762218395", "150576065898272018891775047669829697250", "99093443172534087957134213695478714840", "68325700730845866094341915591581307187", "286631698032773071215015196228979343683", "18557811733393216243903401517338271366", "195882257073343796526581030205703894775"], "threshold":0.9}, "id":"ASB-A-446114623-cbb44d3d", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/stack/smp/smp_api.cc"}}, {"deprecated":false, "digest":{"line_hashes":["100727786838966863813576275650918830927", "302785215380627947201490088425033914126", "721912710162226081753766627442149853", "295156729140876187168719648332815648602", "92055565271584275089027511401768665547", "215076257516853364270042412709744929827", "27000083482802005177720939971482819847", "135824465954853681109745544097732915916", "284463877033300790443222191866180354240", "126233690925395534068000546720249108983"], "threshold":0.9}, "id":"ASB-A-446114623-d87c4b27", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/stack/smp/smp_keys.cc"}}, {"deprecated":false, "digest":{"line_hashes":["49157123252023048688622859836436198373", "34375521022880235426547635898748580295", "285764992564967563019574871054901057065"], "threshold":0.9}, "id":"ASB-A-446114623-e20be1a4", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/btif/src/btif_dm.cc"}}, {"deprecated":false, "digest":{"function_hash":"47482497051480740807036399382404369366", "length":1730}, "id":"ASB-A-446114623-f88015d2", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/stack/smp/smp_api.cc", "function":"SMP_SecurityGrant"}}, {"deprecated":false, "digest":{"function_hash":"146555786058315370635701691470227337210", "length":2285}, "id":"ASB-A-446114623-fe414dd5", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f", "target":{"file":"system/stack/btm/btm_sec.cc", "function":"btm_sec_pairing_timeout"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2026-06-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ce76f82dac2a8e0e247ca9c838bda57fb9a27b04"}]}