CVE-2026-74507: Bluetooth: HIDP: validate numbered report payloads

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: validate numbered report payloads

When hidpgetrawreport() waits for a numbered report, hidpprocessdata() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed.

KMSAN reports an uninitialized-value use in hidpsessionrun(), with the value originating in allocskb() through vhciwrite(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added.

The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds.

Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.

Affected Software

1 affected component
Linux Linux kernel

Event History

Aug 15, 2026
CVE Published
via MITRE·12:27 PM
Data Sourced
via MITRE·12:27 PM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-74507?

CVE-2026-74507 has a risk rating of 23, indicating a significant vulnerability.

2

How do I fix CVE-2026-74507?

To address CVE-2026-74507, ensure your Linux kernel is updated to the latest version where the vulnerability has been patched.

3

What impact does CVE-2026-74507 have on systems?

CVE-2026-74507 allows a connected HIDP peer to exploit the system by potentially sending incorrect data reports, which could lead to unexpected behavior.

4

Which versions of the Linux kernel are affected by CVE-2026-74507?

CVE-2026-74507 affects specific versions of the Linux kernel prior to the release that includes the fix.

5

Is CVE-2026-74507 a remote code execution vulnerability?

CVE-2026-74507 does not directly facilitate remote code execution but can allow an attacker to manipulate data traffic in a connected HIDP session.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203