CVE-2026-74508

Status: UPDATED  |  Advisory ID: CVE-2026-74508

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: reject frames without a transaction header

hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]

before checking that the L2CAP SDU contains a transaction header. A

connected HIDP peer can send an empty basic-mode SDU and make both paths

use an uninitialized byte from skb tailroom.

KMSAN reports the use in hidp_session_run(), with the uninitialized value

originating in __alloc_skb() through vhci_write(). The control path

produces two reports and the interrupt path produces one.

The byte can also be controlled by a malformed lower-layer packet. If an

HCI ACL packet contains an L2CAP PDU with a declared zero-length payload

followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to

the declared PDU length before dispatch. The current HIDP path nevertheless

consumes the extra byte as HIDP_TRANS_HID_CONTROL |

HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this

change, the same packet is discarded and a subsequent feature report

request succeeds.

Pull the transaction header with skb_pull_data() and discard frames that

do not contain it. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References