CVE-2026-74507 - Vulnerability Details

- Bluetooth: HIDP: validate numbered report payloads

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: validate numbered report payloads

When hidp_get_raw_report() waits for a numbered report,
hidp_process_data() compares the expected report number with skb->data[0].
A connected HIDP peer can reply with only a DATA transaction header,
leaving the skb empty after the header is removed.

KMSAN reports an uninitialized-value use in hidp_session_run(), with the
value originating in __alloc_skb() through vhci_write(). The transaction
header checks remove the empty-frame reports, but this report remains until
the payload check is added.

The comparison can also consume a peer-controlled byte beyond the declared
L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made
the current code accept that byte as report ID 1 and complete
HIDIOCGFEATURE with a zero-byte result. With this change the malformed
response is rejected with -EIO, while a subsequent valid response still
succeeds.

Require a payload byte before comparing a numbered report ID. Unnumbered
reports continue to accept an empty payload.

Published: 2026-08-15

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s Bluetooth HID Protocol driver, a received numbered report is compared against a value in the socket buffer without first confirming that a payload byte actually exists. This oversight can lead to an out‑of‑bounds read or use of an uninitialized value, potentially causing the kernel to crash or halt the HID subsystem. No code execution or privilege escalation is currently possible, but a kernel panic would disrupt services that rely on the Bluetooth HID interface.

Affected Systems

Any Linux kernel that has not incorporated the HIDP payload validation fix is vulnerable. This includes mainstream distribution kernel releases as well as embedded Linux devices that enable Bluetooth HID support. Devices that expose the Bluetooth HID interface and accept peer‑controlled input are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate‑to‑high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to establish an active Bluetooth HID connection and send specially crafted reports; successful exploitation would primarily produce a kernel error or denial of the HID service rather than data compromise or system takeover.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< 011bf4350d941f1995b2bd4b815ee206cacf2b8e
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< 689d8bb7fee96b7196b572b015b6055c6616ce0c
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< c73beb320f5705e508bf7d385b8cc5ef8d9c8b69
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< b7ad105d46acd828e424454815e4cd31069e047a
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< 7e7162427659b70ea17cd41b1f79e2e64c246690
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< 27cc0e603355c585f1e5da8398faa4d36d498188
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< 9c841f59e10b5d75c398a3fc6b2da448d2a2276b
`0ff1731a1ae51e8e48cd559d70db536281c47f8e`	affected	< 34f53d27b81a16a02828c8fdfa4e02badc326f17

Linux

affected

Version	Status	Constraints
`2.6.39`	affected	—
`0`	unaffected	< 2.6.39
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0ff1731a1ae51e8e48cd559d70db536281c47f8e,b7ad105d46acd828e424454815e4cd31069e047a)`	affected	code_commit	—
`[0ff1731a1ae51e8e48cd559d70db536281c47f8e,7e7162427659b70ea17cd41b1f79e2e64c246690)`	affected	code_commit	—
`[0ff1731a1ae51e8e48cd559d70db536281c47f8e,27cc0e603355c585f1e5da8398faa4d36d498188)`	affected	code_commit	—
`[0ff1731a1ae51e8e48cd559d70db536281c47f8e,9c841f59e10b5d75c398a3fc6b2da448d2a2276b)`	affected	code_commit	—
`[0ff1731a1ae51e8e48cd559d70db536281c47f8e,34f53d27b81a16a02828c8fdfa4e02badc326f17)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.39`	affected	semver	—
`[0,2.6.39)`	unaffected	semver	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that introduces the HIDP payload validation, or update to a kernel release that includes the fix.
Disable the Bluetooth HID interface on systems that do not require HID support, for example by stopping the Bluetooth service or blocking L2CAP traffic from untrusted devices.
If patching or disabling is not possible, use firewall rules to restrict L2CAP connections to trusted devices only.

Generated by OpenCVE AI on August 22, 2026 at 00:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00242.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/011bf4350d941f1995b2bd4b815ee206cacf2b8e
https://git.kernel.org/stable/c/27cc0e603355c585f1e5da8398faa4d36d498188
https://git.kernel.org/stable/c/34f53d27b81a16a02828c8fdfa4e02badc326f17
https://git.kernel.org/stable/c/689d8bb7fee96b7196b572b015b6055c6616ce0c
https://git.kernel.org/stable/c/7e7162427659b70ea17cd41b1f79e2e64c246690
https://git.kernel.org/stable/c/9c841f59e10b5d75c398a3fc6b2da448d2a2276b
https://git.kernel.org/stable/c/b7ad105d46acd828e424454815e4cd31069e047a
https://git.kernel.org/stable/c/c73beb320f5705e508bf7d385b8cc5ef8d9c8b69
https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74507-2e79@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74507
https://www.cve.org/CVERecord?id=CVE-2026-74507

History

Fri, 21 Aug 2026 23:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-125 CWE-665

Fri, 21 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74507-2e79@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74507 https://www.cve.org/CVERecord?id=CVE-2026-74507
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 19 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/011bf4350d941f1995b2bd4b815ee206cacf2b8e https://git.kernel.org/stable/c/689d8bb7fee96b7196b572b015b6055c6616ce0c https://git.kernel.org/stable/c/c73beb320f5705e508bf7d385b8cc5ef8d9c8b69

Mon, 17 Aug 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125 CWE-665

Mon, 17 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-457

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N'}`

Sat, 15 Aug 2026 17:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-457

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA \| FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.
Title		Bluetooth: HIDP: validate numbered report payloads
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/27cc0e603355c585f1e5da8398faa4d36d498188 https://git.kernel.org/stable/c/34f53d27b81a16a02828c8fdfa4e02badc326f17 https://git.kernel.org/stable/c/7e7162427659b70ea17cd41b1f79e2e64c246690 https://git.kernel.org/stable/c/9c841f59e10b5d75c398a3fc6b2da448d2a2276b https://git.kernel.org/stable/c/b7ad105d46acd828e424454815e4cd31069e047a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:30.683Z

Updated: 2026-08-19T16:38:05.065Z

Reserved: 2026-08-15T05:44:03.908Z

Link: CVE-2026-74507

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:55.733

Modified: 2026-08-19T17:21:07.643

Link: CVE-2026-74507

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74507 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T00:30:16Z

Weaknesses

CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object