Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-74507

Bluetooth: HIDP: validate numbered report payloads

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, and 2 more
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • Linux Linux

    From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in 011bf4350d941f1995b2bd4b815ee206cacf2b8e; From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in 689d8bb7fee96b7196b572b015b6055c6616ce0c; From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in c73beb320f5705e508bf7d385b8cc5ef8d9c8b69; From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in b7ad105d46acd828e424454815e4cd31069e047a; From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in 7e7162427659b70ea17cd41b1f79e2e64c246690; From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in 27cc0e603355c585f1e5da8398faa4d36d498188; From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in 9c841f59e10b5d75c398a3fc6b2da448d2a2276b; From 0ff1731a1ae51e8e48cd559d70db536281c47f8e · fixed in 34f53d27b81a16a02828c8fdfa4e02badc326f17

  • Linux Linux

    2.6.39

  • KernelLinux

    From 2.6.39 · fixed in 5.10.265; From 5.11.0 · fixed in 5.15.216; From 5.16.0 · fixed in 6.1.183; From 6.2.0 · fixed in 6.6.151; From 6.7.0 · fixed in 6.12.103; From 6.13.0 · fixed in 6.18.44; From 6.19.0 · fixed in 7.1.8

References 8

git.kernel.org