CVE-2026-74508
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom. KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one. The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds. Pull the transaction header with skb_pull_data() and discard frames that do not contain it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-74508
EUVD
EUVD-2026-59701

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves Bluetooth HIDP (Human Interface Device Protocol) handling. It allows a connected peer to send an empty frame without a transaction header, causing the kernel to read an uninitialized memory byte. This can lead to undefined behavior or potential security issues.

Detection Guidance

This vulnerability involves Bluetooth HIDP frames without transaction headers. Detection requires monitoring Bluetooth traffic for malformed HIDP frames. Use tools like btmon or hcidump to capture and inspect Bluetooth packets. Look for L2CAP SDUs with zero-length payloads followed by unexpected bytes. Check kernel logs for HIDP session errors or crashes.

Impact Analysis

An attacker within Bluetooth range could exploit this to cause a denial of service, crash the system, or potentially execute arbitrary code. It may also allow unauthorized access to Bluetooth HID devices if the system is compromised.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Disable Bluetooth HIDP if not needed. Restrict Bluetooth device connections to trusted peers. Monitor for suspicious Bluetooth traffic patterns. Apply vendor patches if available for your distribution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74508. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart