CVE-2026-74507Bluetooth: HIDP: validate numbered report payloads
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before 011bf4350d941f1995b2bd4b815ee206cacf2b8e; from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before 689d8bb7fee96b7196b572b015b6055c6616ce0c; from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before c73beb320f5705e508bf7d385b8cc5ef8d9c8b69; from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before b7ad105d46acd828e424454815e4cd31069e047a; from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before 7e7162427659b70ea17cd41b1f79e2e64c246690; from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before 27cc0e603355c585f1e5da8398faa4d36d498188; from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before 9c841f59e10b5d75c398a3fc6b2da448d2a2276b; from 0ff1731a1ae51e8e48cd559d70db536281c47f8e before 34f53d27b81a16a02828c8fdfa4e02badc326f17 | CNA record |
References
- https://git.kernel.org/stable/c/011bf4350d941f1995b2bd4b815ee206cacf2b8e
- https://git.kernel.org/stable/c/689d8bb7fee96b7196b572b015b6055c6616ce0c
- https://git.kernel.org/stable/c/c73beb320f5705e508bf7d385b8cc5ef8d9c8b69
- https://git.kernel.org/stable/c/b7ad105d46acd828e424454815e4cd31069e047a
- https://git.kernel.org/stable/c/7e7162427659b70ea17cd41b1f79e2e64c246690
- https://git.kernel.org/stable/c/27cc0e603355c585f1e5da8398faa4d36d498188
- https://git.kernel.org/stable/c/9c841f59e10b5d75c398a3fc6b2da448d2a2276b
- https://git.kernel.org/stable/c/34f53d27b81a16a02828c8fdfa4e02badc326f17
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.