{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74507","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-15T05:44:03.908Z","datePublished":"2026-08-15T12:27:30.683Z","dateUpdated":"2026-08-19T16:38:05.065Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-19T16:38:05.065Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: validate numbered report payloads\n\nWhen hidp_get_raw_report() waits for a numbered report,\nhidp_process_data() compares the expected report number with skb->data[0].\nA connected HIDP peer can reply with only a DATA transaction header,\nleaving the skb empty after the header is removed.\n\nKMSAN reports an uninitialized-value use in hidp_session_run(), with the\nvalue originating in __alloc_skb() through vhci_write(). The transaction\nheader checks remove the empty-frame reports, but this report remains until\nthe payload check is added.\n\nThe comparison can also consume a peer-controlled byte beyond the declared\nL2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made\nthe current code accept that byte as report ID 1 and complete\nHIDIOCGFEATURE with a zero-byte result. With this change the malformed\nresponse is rejected with -EIO, while a subsequent valid response still\nsucceeds.\n\nRequire a payload byte before comparing a numbered report ID. Unnumbered\nreports continue to accept an empty payload."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","baseScore":7.1,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The flaw is reached when a connected Bluetooth HIDP peer sends crafted DATA frames over the established L2CAP control channel; Bluetooth is an adjacent wireless vector, not local syscall/ioctl or physical USB access.\nAC:L - The malicious peer receives the host GET_REPORT and can deterministically reply with a header-only DATA frame or a malformed numbered-report payload; no race or rare layout conditions beyond an active HIDP session are required.\nPR:N - Exploitation is performed by the remote Bluetooth HIDP peer sending malicious protocol data; the attacker needs no local account, capabilities, or init-namespace root on the victim host.\nUI:N - Once a HIDP session exists, the peer can trigger the bug by answering host-initiated GET_REPORT requests from HIDIOCGFEATURE or kernel HID probe I/O without any additional victim action at exploit time.\nS:U - Impact is confined to kernel Bluetooth HIDP/hidraw handling on the victim host; it does not cross a VM, container, or IOMMU security boundary to affect a separate authority.\nC:H - With numbered reports, hidp_process_data() reads skb->data[0] when skb->len is zero or beyond the declared L2CAP PDU, causing an out-of-bounds/uninitialized heap read that may contain stale kernel memory.\nI:L - Accepting malformed numbered-report responses can complete HIDIOCGFEATURE with incorrect zero-length or attacker-chosen report-ID data, causing limited integrity impact on returned HID feature-report contents.\nA:N - The defect is an invalid payload-length check and uninitialized/OOB read during report matching; it does not cause a documented kernel oops, panic, hang, or repeatable denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/hidp/core.c"],"versions":[{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"011bf4350d941f1995b2bd4b815ee206cacf2b8e","status":"affected","versionType":"git"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"689d8bb7fee96b7196b572b015b6055c6616ce0c","status":"affected","versionType":"git"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"c73beb320f5705e508bf7d385b8cc5ef8d9c8b69","status":"affected","versionType":"git"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"b7ad105d46acd828e424454815e4cd31069e047a","status":"affected","versionType":"git"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"7e7162427659b70ea17cd41b1f79e2e64c246690","status":"affected","versionType":"git"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"27cc0e603355c585f1e5da8398faa4d36d498188","status":"affected","versionType":"git"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"9c841f59e10b5d75c398a3fc6b2da448d2a2276b","status":"affected","versionType":"git"},{"version":"0ff1731a1ae51e8e48cd559d70db536281c47f8e","lessThan":"34f53d27b81a16a02828c8fdfa4e02badc326f17","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/hidp/core.c"],"versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","status":"unaffected","versionType":"semver"},{"version":"5.10.265","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.216","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.183","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.151","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.103","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.44","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.8","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"5.10.265"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"5.15.216"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.1.183"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.6.151"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.12.103"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"6.18.44"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.39","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/011bf4350d941f1995b2bd4b815ee206cacf2b8e"},{"url":"https://git.kernel.org/stable/c/689d8bb7fee96b7196b572b015b6055c6616ce0c"},{"url":"https://git.kernel.org/stable/c/c73beb320f5705e508bf7d385b8cc5ef8d9c8b69"},{"url":"https://git.kernel.org/stable/c/b7ad105d46acd828e424454815e4cd31069e047a"},{"url":"https://git.kernel.org/stable/c/7e7162427659b70ea17cd41b1f79e2e64c246690"},{"url":"https://git.kernel.org/stable/c/27cc0e603355c585f1e5da8398faa4d36d498188"},{"url":"https://git.kernel.org/stable/c/9c841f59e10b5d75c398a3fc6b2da448d2a2276b"},{"url":"https://git.kernel.org/stable/c/34f53d27b81a16a02828c8fdfa4e02badc326f17"}],"title":"Bluetooth: HIDP: validate numbered report payloads","x_generator":{"engine":"bippy-1.2.0"}}}}