CVE-2026-63947 - Vulnerability Details

- Bluetooth: HIDP: fix missing length checks in hidp_input_report()

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: fix missing length checks in hidp_input_report()

hidp_input_report() reads keyboard and mouse payload data from an skb
without first verifying that skb->len contains enough data.

hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching
to hidp_input_report(). If a paired device sends a truncated packet,
the handler reads beyond the valid skb data, resulting in an
out-of-bounds read of skb data. The OOB bytes may be interpreted as
phantom key presses or spurious mouse movement.

Replace the open-coded length tracking and pointer arithmetic with
skb_pull_data() calls. skb_pull_data() returns NULL if the requested
bytes are not present, eliminating the need for a manual size variable
and the separate skb->len guard.

Published: 2026-07-19

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel's Bluetooth HIDP subsystem contains an out-of-bounds read in the hidp_input_report() function. When a Bluetooth device sends a truncated HID report, the code reads past the packet boundary, causing data beyond the legitimate payload to be interpreted as bogus key presses or mouse movements. This flaw is classified as CWE‑125 and can compromise the integrity of user input on the affected system.

Affected Systems

The vulnerability applies to any Linux kernel that includes the Bluetooth HIDP subsystem and has not yet incorporated the recent length‑check fix. This includes all kernel releases that provide Bluetooth HID over GATT support for keyboards and mice, regardless of distribution vendor.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% reflects a very low probability of exploitation. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to send a crafted HID report over Bluetooth from a device that either is already paired or can initiate a Bluetooth session with the target. The vulnerability does not require elevated privileges on the target system, but the attack vector would generally be local or device‑side via Bluetooth communications.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 1f08a90013e1e632b34321334e861fcefc056505
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< cc3832b19f863e3677c5651f001a2e3795f39eb8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d313683d6ccdd8c01e0562270a2ae25b86d8461d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d7d6a81b8dd1a8d084a1b755db9406041d53adb5
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 6348dfed5b0f9c6074f14322332e97493d32fef0
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b83dcacd2ec7fcc5a48be215f82d573759f87ec2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1f08a90013e1e632b34321334e861fcefc056505)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,cc3832b19f863e3677c5651f001a2e3795f39eb8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d313683d6ccdd8c01e0562270a2ae25b86d8461d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d7d6a81b8dd1a8d084a1b755db9406041d53adb5)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,6348dfed5b0f9c6074f14322332e97493d32fef0)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b83dcacd2ec7fcc5a48be215f82d573759f87ec2)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that includes the hidp_input_report() length‑check improvement, ensuring the patch is baked into your distribution’s mainline or LTS release.
Restart the Bluetooth subsystem or reboot the system so the patched kernel is active.
If HID over GATT support is not required, disable or blacklist the kernel modules that provide Bluetooth HID functionality to reduce exposure.

Generated by OpenCVE AI on August 4, 2026 at 06:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00337.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505
https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6
https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0
https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2
https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8
https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d
https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5
https://lore.kernel.org/linux-cve-announce/2026071954-CVE-2026-63947-dc2f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63947
https://www.cve.org/CVERecord?id=CVE-2026-63947

History

Wed, 22 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026071954-CVE-2026-63947-dc2f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63947 https://www.cve.org/CVERecord?id=CVE-2026-63947
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement. Replace the open-coded length tracking and pointer arithmetic with skb_pull_data() calls. skb_pull_data() returns NULL if the requested bytes are not present, eliminating the need for a manual size variable and the separate skb->len guard.
Title		Bluetooth: HIDP: fix missing length checks in hidp_input_report()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505 https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6 https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0 https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2 https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8 https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:55:41.306Z

Updated: 2026-08-05T12:37:34.167Z

Reserved: 2026-07-19T07:54:57.023Z

Link: CVE-2026-63947

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63947 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T06:45:03Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object