{"id":"CVE-2026-63947","title":"Bluetooth: HIDP: fix missing length checks in hidp_input_report()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: fix missing length checks in hidp_input_report()\n\nhidp_input_report() reads keyboard and mouse payload data from an skb\nwithout first verifying that sk…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1f08a90013e1e632b34321334e861fcefc056505","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cc3832b19f863e3677c5651f001a2e3795f39eb8","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d313683d6ccdd8c01e0562270a2ae25b86d8461d","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d7d6a81b8dd1a8d084a1b755db9406041d53adb5","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6348dfed5b0f9c6074f14322332e97493d32fef0","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b83dcacd2ec7fcc5a48be215f82d573759f87ec2","Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6","Linux 2.6.12"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:34:08.064493Z"},"published":"2026-07-19","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:42:14.377Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63947","references":[{"url":"https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505"},{"url":"https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8"},{"url":"https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d"},{"url":"https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5"},{"url":"https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0"},{"url":"https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2"},{"url":"https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6"}],"tags":["cve.org"],"epss":0.00346,"epssPercentile":0.26574,"ingestedAt":"2026-10-16T17:24:46.785Z","slug":"CVE-2026-63947","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: fix missing length checks in hidp_input_report()\n\nhidp_input_report() reads keyboard and mouse payload data from an skb\nwithout first verifying that skb->len contains enough data.\n\nhidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching\nto hidp_input_report(). If a paired device sends a truncated packet,\nthe handler reads beyond the valid skb data, resulting in an\nout-of-bounds read of skb data. The OOB bytes may be interpreted as\nphantom key presses or spurious mouse movement.\n\nReplace the open-coded length tracking and pointer arithmetic with\nskb_pull_data() calls. skb_pull_data() returns NULL if the requested\nbytes are not present, eliminating the need for a manual size variable\nand the separate skb->len guard.\n\n## Affected\n\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1f08a90013e1e632b34321334e861fcefc056505`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < cc3832b19f863e3677c5651f001a2e3795f39eb8`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d313683d6ccdd8c01e0562270a2ae25b86d8461d`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d7d6a81b8dd1a8d084a1b755db9406041d53adb5`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 6348dfed5b0f9c6074f14322332e97493d32fef0`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b83dcacd2ec7fcc5a48be215f82d573759f87ec2`\n- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6`\n- `Linux 2.6.12`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}