Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-63947

Bluetooth: HIDP: fix missing length checks in hidp_input_report()

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, and 1 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: total

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement. Replace the open-coded length tracking and pointer arithmetic with skb_pull_data() calls. skb_pull_data() returns NULL if the requested bytes are not present, eliminating the need for a manual size variable and the separate skb->len guard.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • Linux Linux

    From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 1f08a90013e1e632b34321334e861fcefc056505; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in cc3832b19f863e3677c5651f001a2e3795f39eb8; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in d313683d6ccdd8c01e0562270a2ae25b86d8461d; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in d7d6a81b8dd1a8d084a1b755db9406041d53adb5; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 6348dfed5b0f9c6074f14322332e97493d32fef0; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in b83dcacd2ec7fcc5a48be215f82d573759f87ec2; From 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 · fixed in 2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6

  • Linux Linux

    2.6.12

  • KernelLinux

    From 2.6.12 · fixed in 5.15.210; From 5.16.0 · fixed in 6.1.176; From 6.2.0 · fixed in 6.6.143; From 6.7.0 · fixed in 6.12.93; From 6.13.0 · fixed in 6.18.35; From 6.19.0 · fixed in 7.0.12

References 7

git.kernel.org