CVE-2026-74507

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: validate numbered report payloads

When hidp_get_raw_report() waits for a numbered report,

hidp_process_data() compares the expected report number with skb->data[0].

A connected HIDP peer can reply with only a DATA transaction header,

leaving the skb empty after the header is removed.

KMSAN reports an uninitialized-value use in hidp_session_run(), with the

value originating in __alloc_skb() through vhci_write(). The transaction

header checks remove the empty-frame reports, but this report remains until

the payload check is added.

The comparison can also consume a peer-controlled byte beyond the declared

L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made

the current code accept that byte as report ID 1 and complete

HIDIOCGFEATURE with a zero-byte result. With this change the malformed

response is rejected with -EIO, while a subsequent valid response still

succeeds.

Require a pa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References