CVE-2026-74507
Received Received - Intake

Bluetooth HIDP Numbered Report Payload Validation Flaw

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74507
EUVD
EUVD-2026-59700

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves Bluetooth HIDP (Human Interface Device Protocol) where a connected peer can send a malformed response. The issue occurs when the system expects a numbered report but receives an empty payload after a header, leading to an uninitialized-value use in hidp_session_run(). Additionally, a peer-controlled byte beyond the declared L2CAP PDU can be consumed, causing incorrect report ID acceptance and zero-byte results in HIDIOCGFEATURE.

Detection Guidance

This vulnerability affects the Linux kernel's Bluetooth HIDP (Human Interface Device Protocol) subsystem. Detection requires checking kernel logs for Bluetooth-related errors or examining kernel memory for uninitialized value usage in hidp_session_run(). No specific commands are provided in the context, but monitoring for Bluetooth HIDP errors in dmesg or syslog may help identify exploitation attempts.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause undefined behavior in the kernel, potentially leading to crashes, data corruption, or unauthorized access. Systems relying on Bluetooth HID devices may experience instability or incorrect input handling.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-74507. Disable Bluetooth HIDP support if not required by unloading the hidp module (rmmod hidp). Restrict Bluetooth device connections to trusted peers only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74507. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart