CVE-2026-74508 - Vulnerability Details

- Bluetooth: HIDP: reject frames without a transaction header

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: reject frames without a transaction header

hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]
before checking that the L2CAP SDU contains a transaction header. A
connected HIDP peer can send an empty basic-mode SDU and make both paths
use an uninitialized byte from skb tailroom.

KMSAN reports the use in hidp_session_run(), with the uninitialized value
originating in __alloc_skb() through vhci_write(). The control path
produces two reports and the interrupt path produces one.

The byte can also be controlled by a malformed lower-layer packet. If an
HCI ACL packet contains an L2CAP PDU with a declared zero-length payload
followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to
the declared PDU length before dispatch. The current HIDP path nevertheless
consumes the extra byte as HIDP_TRANS_HID_CONTROL |
HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this
change, the same packet is discarded and a subsequent feature report
request succeeds.

Pull the transaction header with skb_pull_data() and discard frames that
do not contain it.

Published: 2026-08-15

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Ignoring the required transaction header, the HIDP layer reads an uninitialized byte from the packet. In a Bluetooth HID device stream, a crafted empty SDU or malformed lower‑layer packet can supply this byte, causing the kernel to use it as a control code. This leads to the termination of the HIDP session, disrupting the Bluetooth service and resulting in a denial of service. The flaw arises from uninitialized memory usage.

Affected Systems

Linux kernel builds that have not incorporated the commit adding the transaction‑header verification are vulnerable. Any distribution running a kernel version before the patch and which has the HIDP module enabled and Bluetooth stack active will be susceptible. Systems that disable Bluetooth HIDP or do not load the module are unaffected.

Risk and Exploitability

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests an extremely low exploitation probability. The flaw is not listed in CISA’s KEV catalog. Exploitation requires a malicious Bluetooth HID device that can send specially crafted packets, which can be delivered at physical proximity to the target. No local privileges or system authentication are required, and the impact is limited to the Bluetooth service and the device’s responsiveness.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 238c333bc4b3f245c626632e8bfa3c9dab97f51b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 567a2a0a633f2ea5fdccaf3517c09f22c9d860c7
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 97b61241ab45bfa5b0526cb0f3978942493bc811
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2ebf63aa557a69990b4e9ea22be224d58aabce96
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 854194494a6f726a60b90b76059148bf08df023d
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 47778d2c2087b5d192398f6fddf692d16a5431cf

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.266`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,97b61241ab45bfa5b0526cb0f3978942493bc811)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2ebf63aa557a69990b4e9ea22be224d58aabce96)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,854194494a6f726a60b90b76059148bf08df023d)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,47778d2c2087b5d192398f6fddf692d16a5431cf)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.6.151,6.7.0)`	unaffected	semver	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel commit that adds the transaction‑header check to the HIDP layer.
Reboot the system to load the updated kernel and ensure the fix is active.
If a kernel upgrade is not immediately possible, unload or disable the hidp module or turn off Bluetooth services to prevent the vulnerability from being triggered.

Generated by OpenCVE AI on August 18, 2026 at 05:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00262.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/238c333bc4b3f245c626632e8bfa3c9dab97f51b
https://git.kernel.org/stable/c/24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8
https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96
https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec
https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf
https://git.kernel.org/stable/c/567a2a0a633f2ea5fdccaf3517c09f22c9d860c7
https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d
https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811
https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74508-e6eb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74508
https://www.cve.org/CVERecord?id=CVE-2026-74508

History

Sun, 23 Aug 2026 13:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8

Wed, 19 Aug 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/238c333bc4b3f245c626632e8bfa3c9dab97f51b https://git.kernel.org/stable/c/567a2a0a633f2ea5fdccaf3517c09f22c9d860c7

Tue, 18 Aug 2026 04:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-788

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026081542-CVE-2026-74508-e6eb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74508 https://www.cve.org/CVERecord?id=CVE-2026-74508
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-788

Mon, 17 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-789

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-789

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom. KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one. The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL \| HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds. Pull the transaction header with skb_pull_data() and discard frames that do not contain it.
Title		Bluetooth: HIDP: reject frames without a transaction header
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96 https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:27:31.288Z

Updated: 2026-08-23T12:47:28.838Z

Reserved: 2026-08-15T05:44:03.908Z

Link: CVE-2026-74508

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:17:55.843

Modified: 2026-08-23T13:16:44.990

Link: CVE-2026-74508

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74508 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T05:45:03Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object