CVE-2026-74507: Bluetooth: HIDP: validate numbered report payloads
Vulnerability summary
CVE-2026-74507 is a high (CVSS 7.1) vulnerability in linux. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 15.4% of scored vulnerabilities.
Not severe (CVSS 7.1, adjacent network); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 8Timeline
- 15-08-2026PublishedVulnerability first disclosed.
- 16-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
- NVDNIST7.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
Decrease -0.11 pp
From 0.35% on 06-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: adjacent network, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu169 products
- linuxAll versions (No fix recorded) | < 5.15.0-198.208 | < 7.0.0-42.42
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1117.124 | < 7.0.0-1016.17
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Debian2 products
- linux< 6.1.187-1 | < 6.12.105-1 | < 7.1.8-1
- linux-6.12< 6.12.107-1~deb12u1
Linux1 product
- linux≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < 011bf4350d941f1995b2bd4b815ee206cacf2b8e | ≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < 689d8bb7fee96b7196b572b015b6055c6616ce0c | ≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < c73beb320f5705e508bf7d385b8cc5ef8d9c8b69 | ≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < b7ad105d46acd828e424454815e4cd31069e047a | ≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < 7e7162427659b70ea17cd41b1f79e2e64c246690 | ≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < 27cc0e603355c585f1e5da8398faa4d36d498188 | ≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < 9c841f59e10b5d75c398a3fc6b2da448d2a2276b | ≥ 0ff1731a1ae51e8e48cd559d70db536281c47f8e, < 34f53d27b81a16a02828c8fdfa4e02badc326f17 | 2.6.39
3 vendors · 172 products
