CVE-2026-74508: Bluetooth: HIDP: reject frames without a transaction header
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: HIDP: reject frames without a transaction header
hidprecvctrlframe() and hidprecvintrframe() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom.
KMSAN reports the use in hidpsessionrun(), with the uninitialized value originating in allocskb() through vhciwrite(). The control path produces two reports and the interrupt path produces one.
The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2caprecvacldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDPTRANSHIDCONTROL | HIDPCTRLVIRTUALCABLEUNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds.
Pull the transaction header with skbpulldata() and discard frames that do not contain it.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74508?
CVE-2026-74508 has a risk rating of 23, indicating a significant vulnerability.
How do I fix CVE-2026-74508?
To fix CVE-2026-74508, update to the latest version of the Linux kernel where this vulnerability has been addressed.
What systems are affected by CVE-2026-74508?
CVE-2026-74508 affects the Linux kernel, particularly functionality related to Bluetooth HIDP connections.
What kind of attack does CVE-2026-74508 enable?
CVE-2026-74508 allows a connected HIDP peer to potentially exploit the lack of a transaction header, leading to undefined behavior.
When was CVE-2026-74508 published?
CVE-2026-74508 was published on August 15, 2026.