{"id":"ASB-A-446114623","details":"In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-446114623","CVE-2026-0097"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2026-06-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2026-06-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/ce76f82dac2a8e0e247ca9c838bda57fb9a27b04"}],"affected":[{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17-next:0"},{"fixed":"17-next:2026-06-01"}]}],"versions":["17-next"],"ecosystem_specific":{"severity":"Critical","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b9ddeb3bc5b0524090266d3b7a46e36358ff889e","target":{"file":"system/btif/src/btif_dm.cc","function":"btif_dm_ble_passkey_notif_evt"},"deprecated":false,"digest":{"length":680,"function_hash":"31734972081692157849199047156492603822"},"id":"ASB-A-446114623-10c44270","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_pairing_timeout"},"deprecated":false,"digest":{"length":2666,"function_hash":"231539311707053842326511678580377737895"},"id":"ASB-A-446114623-1ca21a99","signature_type":"Function"},{"digest":{"function_hash":"234584975023575567124225679617481991260","length":710},"id":"ASB-A-446114623-2977a00d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"function":"smp_process_stk","file":"system/stack/smp/smp_keys.cc"},"deprecated":false},{"target":{"file":"system/stack/smp/smp_api.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["3625691933843217250556620466896161754","180460862847800584050075945480277025953","60906836200268158500077632011699044505","95116370380363773146327872268626679668","126424637657785920007779609142351287401","21130100456077764852675937240907601578","128977395532420042989448656985969031907","119005825486589151620228838390581756434"]},"id":"ASB-A-446114623-3b4a3a3e","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e9d39624fdb8f7bda9a780ca8b5856ff6f536da8"},{"target":{"function":"SMP_SecurityGrant","file":"system/stack/smp/smp_api.cc"},"deprecated":false,"digest":{"function_hash":"178127102311926419308237471210881399138","length":1579},"id":"ASB-A-446114623-4116de9e","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e9d39624fdb8f7bda9a780ca8b5856ff6f536da8"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","target":{"file":"system/stack/smp/smp_int.h"},"deprecated":false,"digest":{"line_hashes":["81289191322123501918693501470100654319","157475216257162784765266611508645658432","9528417970154818471656132109669991909","256054285687791892655556784859762617024"],"threshold":0.9},"id":"ASB-A-446114623-41370136","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["176717285701819479575032958130622517461","183867214066230886505576089332383521001","41433721140392426110811497754412979388","306843216174972339125173593424615879353","78603013078133253516786784461542205628"],"threshold":0.9},"id":"ASB-A-446114623-662519e5","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"file":"system/stack/smp/smp_api.cc"}},{"id":"ASB-A-446114623-73abf38d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_pairing_timeout"},"deprecated":false,"digest":{"length":3379,"function_hash":"55862323285872360375307587000722879881"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["38123835087497506484898633376779262492","254790785712942926675871187920411883863","223887958365421081987998159018457054059","263430309604587523823369773698866156173","318418757775532371117983830244437272984"]},"id":"ASB-A-446114623-84420aa4"},{"deprecated":false,"digest":{"function_hash":"220425171157758378926929497308020213986","length":320},"id":"ASB-A-446114623-85109113","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","target":{"function":"smp_process_stk","file":"system/stack/smp/smp_keys.cc"}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","target":{"file":"system/stack/smp/smp_api.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["319833472986775829743677446996955382289","3316350120524910748598461943721072516","235345597798508756032276339457177731212","66710247988572523415490192681488114803","60507341712601419771865639621180994164","13150143018615496608642770297194703929","282566932100429070970868609771770702982","239369793877934887817650693000340810966"]},"id":"ASB-A-446114623-8be4b687","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"file":"system/btif/src/btif_dm.cc"},"deprecated":false,"digest":{"line_hashes":["177807944642272413518101036077138371059","161230592689213163205596357226198968735","15005705251139855933323253498756152745","44320203957621936696434678523822654905","189072722545604653230978890036628374192","10247023671915606298415406766517976857","38277492957114325423142317886662723033"],"threshold":0.9},"id":"ASB-A-446114623-8dd53bee","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["6662333090292325639705760121640365949","275834036348265339710929929918284404990","231748124881927304473764699746886958996","330672095353401331477333315344355919999"],"threshold":0.9},"id":"ASB-A-446114623-8df5f244","match_only_versions":["17-next"],"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b9ddeb3bc5b0524090266d3b7a46e36358ff889e","target":{"file":"system/btif/src/btif_dm.cc"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"file":"system/stack/smp/smp_api.cc","function":"SMP_SecurityGrant"},"deprecated":false,"digest":{"function_hash":"116939169766352508570621063001681865988","length":2629},"id":"ASB-A-446114623-a26321f8","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","target":{"function":"SMP_SecurityGrant","file":"system/stack/smp/smp_api.cc"},"deprecated":false,"digest":{"length":1808,"function_hash":"202124529917796476119499478848220356455"},"id":"ASB-A-446114623-acddd301","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["63927108321931861945040975026369331317","331514989418353646555124812436198120819","29961770108354421273276141488602969927","81802989289701521345885942475963581843","100727786838966863813576275650918830927","309040050757110665077071123080589396815","2047050416960220282334025273769055592","71863587375596532448641087288144943144","116368429212860701117145866034827547462","215076257516853364270042412709744929827","27000083482802005177720939971482819847","135824465954853681109745544097732915916","284463877033300790443222191866180354240","126233690925395534068000546720249108983"],"threshold":0.9},"id":"ASB-A-446114623-bddd67af","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","target":{"file":"system/stack/smp/smp_keys.cc"}},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"file":"system/stack/smp/smp_keys.cc"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["165723551067596443627808594304837698616","87551786920624643770589866637267990936","331766078323403503447195387202510417066","334088656154150803903442778856221267703","246255422494265798244045827076173231416","33125095065345972998658848534839993146"]},"id":"ASB-A-446114623-e79c8937"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["131189704953720414700138846275303697508","172308218576201221864339180023870634679","61145065902019251150511510746572720178","148192652637064108730146086683936079856","266999473375592183526936122039934851709","325924926307398868438743302400438361036","137117731029949151760955524973005929415","161116765934229210130791376889146676151","111877256210062223587578662931793003140"]},"id":"ASB-A-446114623-ef6a8d42","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","target":{"file":"system/stack/btm/btm_sec.cc"}},{"id":"ASB-A-446114623-f72774ef","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224","target":{"function":"btif_dm_ble_passkey_notif_evt","file":"system/btif/src/btif_dm.cc"},"deprecated":false,"digest":{"function_hash":"204047544868580953062332776951667461810","length":1234}}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/b9ddeb3bc5b0524090266d3b7a46e36358ff889e","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/4a6f8f383285a2c5a7f17e7e48cb4cdeff9718f2","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/e9d39624fdb8f7bda9a780ca8b5856ff6f536da8","https://android.googlesource.com/platform/packages/modules/Bluetooth/+/8d9bb12908e875776866414c6fcfaa7ccacd3224"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-446114623.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15:0"},{"fixed":"15:2026-06-01"}]}],"versions":["15"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/stack/smp/smp_keys.cc"},"deprecated":false,"digest":{"line_hashes":["100727786838966863813576275650918830927","309040050757110665077071123080589396815","2047050416960220282334025273769055592","71863587375596532448641087288144943144","116368429212860701117145866034827547462","215076257516853364270042412709744929827","27000083482802005177720939971482819847","135824465954853681109745544097732915916","284463877033300790443222191866180354240","126233690925395534068000546720249108983"],"threshold":0.9},"id":"ASB-A-446114623-314f4e78","signature_type":"Line"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"line_hashes":["192065062710062481221664505451915246086","75660366820069275857519294038522055423","234649847864776965351644763574326793960","2375529922056744463974337151852461423","325924926307398868438743302400438361036","137117731029949151760955524973005929415","161116765934229210130791376889146676151","111877256210062223587578662931793003140"],"threshold":0.9},"id":"ASB-A-446114623-372c80ca","signature_type":"Line"},{"digest":{"function_hash":"314876946116844382721454981892951665404","length":1575},"id":"ASB-A-446114623-5a3f94b9","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/stack/smp/smp_api.cc","function":"SMP_SecurityGrant"},"deprecated":false},{"digest":{"threshold":0.9,"line_hashes":["81289191322123501918693501470100654319","157475216257162784765266611508645658432","9528417970154818471656132109669991909","256054285687791892655556784859762617024"]},"id":"ASB-A-446114623-5f68363c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/stack/smp/smp_int.h"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["163429631773481684112422635745762218395","3625691933843217250556620466896161754","180460862847800584050075945480277025953","60906836200268158500077632011699044505","95116370380363773146327872268626679668"],"threshold":0.9},"id":"ASB-A-446114623-9120966f","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/stack/smp/smp_api.cc"}},{"id":"ASB-A-446114623-9eb5df08","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/stack/smp/smp_keys.cc","function":"smp_process_stk"},"deprecated":false,"digest":{"function_hash":"220425171157758378926929497308020213986","length":320}},{"deprecated":false,"digest":{"function_hash":"236880810580940641098025881300735569965","length":2519},"id":"ASB-A-446114623-a31626cc","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_pairing_timeout"}},{"id":"ASB-A-446114623-a97c9e80","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344","target":{"file":"system/btif/src/btif_dm.cc"},"deprecated":false,"digest":{"line_hashes":["233260924195383638897797672176275277200","172612379833823802265443814632088662762","199586038176990265549444358813591772090"],"threshold":0.9}},{"target":{"file":"system/btif/src/btif_dm.cc","function":"btif_dm_ble_key_notif_evt"},"deprecated":false,"digest":{"length":611,"function_hash":"206777208765807015065849958471970014392"},"id":"ASB-A-446114623-f042f615","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/0f15c98705cb0388c3f51c27d1893e0d8ccf7344"],"severity":"Critical","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-446114623.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16:0"},{"fixed":"16:2026-06-01"}]}],"versions":["16"],"ecosystem_specific":{"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c","target":{"function":"smp_process_stk","file":"system/stack/smp/smp_keys.cc"},"deprecated":false,"digest":{"function_hash":"220425171157758378926929497308020213986","length":320},"id":"ASB-A-446114623-08f82c64","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["163429631773481684112422635745762218395","3625691933843217250556620466896161754","180460862847800584050075945480277025953","60906836200268158500077632011699044505","95116370380363773146327872268626679668"],"threshold":0.9},"id":"ASB-A-446114623-244e4094","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c","target":{"file":"system/stack/smp/smp_api.cc"},"deprecated":false},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c","target":{"file":"system/stack/smp/smp_api.cc","function":"SMP_SecurityGrant"},"deprecated":false,"digest":{"length":1579,"function_hash":"178127102311926419308237471210881399138"},"id":"ASB-A-446114623-282a457c","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c","target":{"file":"system/stack/smp/smp_keys.cc"},"deprecated":false,"digest":{"line_hashes":["100727786838966863813576275650918830927","309040050757110665077071123080589396815","2047050416960220282334025273769055592","71863587375596532448641087288144943144","116368429212860701117145866034827547462","215076257516853364270042412709744929827","27000083482802005177720939971482819847","135824465954853681109745544097732915916","284463877033300790443222191866180354240","126233690925395534068000546720249108983"],"threshold":0.9},"id":"ASB-A-446114623-2d514286","signature_type":"Line","signature_version":"v1"},{"target":{"function":"btif_dm_ble_passkey_notif_evt","file":"system/btif/src/btif_dm.cc"},"deprecated":false,"digest":{"function_hash":"248487572407036750071956541583036296578","length":738},"id":"ASB-A-446114623-31c3772a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c","target":{"function":"btm_sec_pairing_timeout","file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"length":2536,"function_hash":"136896882482676993986616802680019165303"},"id":"ASB-A-446114623-39fc0778","signature_type":"Function","signature_version":"v1"},{"id":"ASB-A-446114623-4cf173a8","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c","target":{"file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"line_hashes":["215434611870533229139651467995049986759","317427715601974402403106861030012927387","58814568334906160247402704404540062528","93923946034019918841435357079851949038","325924926307398868438743302400438361036","137117731029949151760955524973005929415","161116765934229210130791376889146676151","111877256210062223587578662931793003140"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c","target":{"file":"system/stack/smp/smp_int.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81289191322123501918693501470100654319","157475216257162784765266611508645658432","9528417970154818471656132109669991909","256054285687791892655556784859762617024"]},"id":"ASB-A-446114623-d4771294","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/76c320443ac2eff5ee4ecb35af134396841c581c"],"severity":"Critical","spl":"2026-06-01","types":["EoP"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-446114623.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16-qpr2:0"},{"fixed":"16-qpr2:2026-06-01"}]}],"versions":["16-qpr2"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2"],"severity":"Critical","spl":"2026-06-01","types":["EoP"],"vanir_signatures":[{"digest":{"function_hash":"31734972081692157849199047156492603822","length":680},"id":"ASB-A-446114623-06a1c855","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2","target":{"file":"system/btif/src/btif_dm.cc","function":"btif_dm_ble_passkey_notif_evt"},"deprecated":false},{"target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_pairing_timeout"},"deprecated":false,"digest":{"length":2591,"function_hash":"198837673737033526891854708781511167648"},"id":"ASB-A-446114623-0757b837","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2","target":{"file":"system/stack/smp/smp_keys.cc"},"deprecated":false,"digest":{"line_hashes":["100727786838966863813576275650918830927","309040050757110665077071123080589396815","2047050416960220282334025273769055592","71863587375596532448641087288144943144","116368429212860701117145866034827547462","215076257516853364270042412709744929827","27000083482802005177720939971482819847","135824465954853681109745544097732915916","284463877033300790443222191866180354240","126233690925395534068000546720249108983"],"threshold":0.9},"id":"ASB-A-446114623-643f02b8","signature_type":"Line"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2","target":{"file":"system/stack/smp/smp_int.h"},"deprecated":false,"digest":{"line_hashes":["81289191322123501918693501470100654319","157475216257162784765266611508645658432","9528417970154818471656132109669991909","256054285687791892655556784859762617024"],"threshold":0.9},"id":"ASB-A-446114623-76dba9f7"},{"id":"ASB-A-446114623-9bc2ba6c","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2","target":{"file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"line_hashes":["61392910550406673329496298584258038198","105151585332266021873448458193517055170","334990437324974967718856186551672711342","218668422234596544083680269256485840524","325924926307398868438743302400438361036","137117731029949151760955524973005929415","161116765934229210130791376889146676151","111877256210062223587578662931793003140"],"threshold":0.9}},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2","target":{"file":"system/stack/smp/smp_keys.cc","function":"smp_process_stk"},"deprecated":false,"digest":{"length":320,"function_hash":"220425171157758378926929497308020213986"},"id":"ASB-A-446114623-f55a5ca6","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2","target":{"function":"SMP_SecurityGrant","file":"system/stack/smp/smp_api.cc"},"deprecated":false,"digest":{"length":1579,"function_hash":"178127102311926419308237471210881399138"},"id":"ASB-A-446114623-f87c1aa0"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/50f677991f1505f15a585523c03bb890033b04f2","target":{"file":"system/stack/smp/smp_api.cc"},"deprecated":false,"digest":{"line_hashes":["163429631773481684112422635745762218395","3625691933843217250556620466896161754","180460862847800584050075945480277025953","60906836200268158500077632011699044505","95116370380363773146327872268626679668"],"threshold":0.9},"id":"ASB-A-446114623-fe95ca27","signature_type":"Line","signature_version":"v1"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-446114623.json"}},{"package":{"name":"platform/packages/modules/Bluetooth","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2026-06-01"}]}],"versions":["14"],"ecosystem_specific":{"types":["EoP"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/stack/btm/btm_sec.cc"},"deprecated":false,"digest":{"line_hashes":["234719483917216146078890080887568829021","244911249944050699601342375503221514997","50815485918381838781077638954734192642","12507181900325330289869155436419730122","95709158769283428854514457943451189248","180575503535316698369877424374383183662","315777261998179110024032758772761492098","184885794012164712733211957678767566916"],"threshold":0.9},"id":"ASB-A-446114623-31ed95e6","signature_type":"Line","signature_version":"v1"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/stack/smp/smp_int.h"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["81289191322123501918693501470100654319","45073608089931919213021578125757594783","160935896494014157170542715010012818982","269525516974204383321594965464893080229"]},"id":"ASB-A-446114623-8c5d57b2","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"length":300,"function_hash":"322084882805485810986258917765237919250"},"id":"ASB-A-446114623-b6c6d35a","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/stack/smp/smp_keys.cc","function":"smp_process_stk"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/btif/src/btif_dm.cc","function":"btif_dm_ble_key_notif_evt"},"deprecated":false,"digest":{"function_hash":"282368559494276747258425239610552102508","length":775},"id":"ASB-A-446114623-ca8006e4","signature_type":"Function"},{"source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/stack/smp/smp_api.cc"},"deprecated":false,"digest":{"line_hashes":["163429631773481684112422635745762218395","150576065898272018891775047669829697250","99093443172534087957134213695478714840","68325700730845866094341915591581307187","286631698032773071215015196228979343683","18557811733393216243903401517338271366","195882257073343796526581030205703894775"],"threshold":0.9},"id":"ASB-A-446114623-cbb44d3d","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/stack/smp/smp_keys.cc"},"deprecated":false,"digest":{"line_hashes":["100727786838966863813576275650918830927","302785215380627947201490088425033914126","721912710162226081753766627442149853","295156729140876187168719648332815648602","92055565271584275089027511401768665547","215076257516853364270042412709744929827","27000083482802005177720939971482819847","135824465954853681109745544097732915916","284463877033300790443222191866180354240","126233690925395534068000546720249108983"],"threshold":0.9},"id":"ASB-A-446114623-d87c4b27","signature_type":"Line"},{"digest":{"line_hashes":["49157123252023048688622859836436198373","34375521022880235426547635898748580295","285764992564967563019574871054901057065"],"threshold":0.9},"id":"ASB-A-446114623-e20be1a4","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/btif/src/btif_dm.cc"},"deprecated":false},{"deprecated":false,"digest":{"length":1730,"function_hash":"47482497051480740807036399382404369366"},"id":"ASB-A-446114623-f88015d2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/stack/smp/smp_api.cc","function":"SMP_SecurityGrant"}},{"digest":{"function_hash":"146555786058315370635701691470227337210","length":2285},"id":"ASB-A-446114623-fe414dd5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f","target":{"file":"system/stack/btm/btm_sec.cc","function":"btm_sec_pairing_timeout"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/packages/modules/Bluetooth/+/57541dad9e1f98f445bd5d25742a96c3f203db6f"],"severity":"Critical","spl":"2026-06-01"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-446114623.json"}}],"schema_version":"1.9.0"}