CVE-2026-74507: Bluetooth: HIDP: validate numbered report payloads
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: HIDP: validate numbered report payloads
When hidpgetrawreport() waits for a numbered report, hidpprocessdata() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed.
KMSAN reports an uninitialized-value use in hidpsessionrun(), with the value originating in allocskb() through vhciwrite(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added.
The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds.
Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74507?
CVE-2026-74507 has a risk rating of 23, indicating a significant vulnerability.
How do I fix CVE-2026-74507?
To address CVE-2026-74507, ensure your Linux kernel is updated to the latest version where the vulnerability has been patched.
What impact does CVE-2026-74507 have on systems?
CVE-2026-74507 allows a connected HIDP peer to exploit the system by potentially sending incorrect data reports, which could lead to unexpected behavior.
Which versions of the Linux kernel are affected by CVE-2026-74507?
CVE-2026-74507 affects specific versions of the Linux kernel prior to the release that includes the fix.
Is CVE-2026-74507 a remote code execution vulnerability?
CVE-2026-74507 does not directly facilitate remote code execution but can allow an attacker to manipulate data traffic in a connected HIDP session.