{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63947","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.023Z","datePublished":"2026-07-19T14:55:41.306Z","dateUpdated":"2026-08-05T12:37:34.167Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:37:34.167Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: fix missing length checks in hidp_input_report()\n\nhidp_input_report() reads keyboard and mouse payload data from an skb\nwithout first verifying that skb->len contains enough data.\n\nhidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching\nto hidp_input_report(). If a paired device sends a truncated packet,\nthe handler reads beyond the valid skb data, resulting in an\nout-of-bounds read of skb data. The OOB bytes may be interpreted as\nphantom key presses or spurious mouse movement.\n\nReplace the open-coded length tracking and pointer arithmetic with\nskb_pull_data() calls. skb_pull_data() returns NULL if the requested\nbytes are not present, eliminating the need for a manual size variable\nand the separate skb->len guard."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The bug is reached when a connected Bluetooth HID peer sends malformed HIDP interrupt (or control DATA) frames over L2CAP ACL; packets traverse HCI → l2cap_recv_acldata() → l2cap_data_channel() → l2cap_sock_recv_cb() → HIDP session thread → hidp_recv_intr_frame()/hidp_process_data() → hidp_input_report(), which is an adjacent Bluetooth attack surface.\nAC:L - Exploitation only requires sending deliberately truncated HIDP input reports on an already-established HIDP/L2CAP session; the attacker fully controls packet length and can trigger the out-of-bounds read reliably on every malformed frame with no race or special memory layout.\nPR:N - The attacker is an external Bluetooth HID device sending L2CAP payloads and needs no Linux account, capability, or namespace privilege; CAP_NET_ADMIN is only required for bluetoothd to register the session, not for the malicious peer to deliver the crafted packets.\nUI:N - Once a HIDP session is active, exploitation is automatic from crafted Bluetooth traffic and requires no further victim action; pairing/connection is an attacker prerequisite, not user interaction at exploit time (consistent with prior Bluetooth HIDP CNA scoring such as CVE-2026-23462).\nS:U - Impact is confined to kernel HIDP/input handling and forged input events delivered within the same kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The vulnerable code performs out-of-bounds reads of up to eight keyboard or four mouse payload bytes beyond skb->len, and per CVSS kernel guidance any out-of-bounds read is rated High because adjacent skb tailroom may contain stale packet or kernel heap data observable through phantom key/mouse event side channels.\nI:H - Out-of-bounds bytes are interpreted as boot-protocol keyboard scancodes and mouse button/movement events, enabling phantom key presses and pointer injection into the system input layer; on laptops, kiosks, automotive consoles, and Android handsets this can forge arbitrary keystrokes/clicks against the active user session.\nA:H - Reading keyboard/mouse payload bytes past valid skb->len is undefined behavior on tightly allocated skbs with no tailroom and can fault the kernel; even when reads stay within tailroom, forged input can repeatedly disrupt session availability on shared/public Bluetooth keyboard deployments, and under the conservative scoring rule this is rated High when crash potential cannot be excluded."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/hidp/core.c"],"versions":[{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"1f08a90013e1e632b34321334e861fcefc056505","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"cc3832b19f863e3677c5651f001a2e3795f39eb8","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d313683d6ccdd8c01e0562270a2ae25b86d8461d","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"d7d6a81b8dd1a8d084a1b755db9406041d53adb5","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"6348dfed5b0f9c6074f14322332e97493d32fef0","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"b83dcacd2ec7fcc5a48be215f82d573759f87ec2","status":"affected","versionType":"git"},{"version":"1da177e4c3f41524e886b7f1b8a0c1fc7321cac2","lessThan":"2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/hidp/core.c"],"versions":[{"version":"2.6.12","status":"affected"},{"version":"0","lessThan":"2.6.12","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.12","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505"},{"url":"https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8"},{"url":"https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d"},{"url":"https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5"},{"url":"https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0"},{"url":"https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2"},{"url":"https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6"}],"title":"Bluetooth: HIDP: fix missing length checks in hidp_input_report()","x_generator":{"engine":"bippy-1.2.0"}}}}