CVE-2026-74507 Bluetooth: HIDP: validate numbered report payloads
A malicious Bluetooth peer can trigger an uninitialized memory read in the Linux kernel HIDP driver, potentially leaking sensitive kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74507?
CVE-2026-74507 is a high-severity vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: HIDP: validate numbered report payloads
When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed.
KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added.
The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds.
Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.
Which versions are affected by CVE-2026-74507?
How do I fix CVE-2026-74507?
Apply the vendor's patch.
Is CVE-2026-74507 being exploited?
There is no known exploitation of CVE-2026-74507 in the wild and no public exploit code.
Sources
Also known as AZL-96255, BELL-CVE-2026-74507, DEBIAN-CVE-2026-74507, GHSA-m9hx-hxv2-v7fm, UBUNTU-CVE-2026-74507.