CVE-2026-74508

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: reject frames without a transaction header

hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]

before checking that the L2CAP SDU contains a transaction header. A

connected HIDP peer can send an empty basic-mode SDU and make both paths

use an uninitialized byte from skb tailroom.

KMSAN reports the use in hidp_session_run(), with the uninitialized value

originating in __alloc_skb() through vhci_write(). The control path

produces two reports and the interrupt path produces one.

The byte can also be controlled by a malformed lower-layer packet. If an

HCI ACL packet contains an L2CAP PDU with a declared zero-length payload

followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to

the declared PDU length before dispatch. The current HIDP path nevertheless

consumes the extra byte as HIDP_TRANS_HID_CONTROL |

HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. Wit

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References