---
id: CVE-2026-74508
title: 'Bluetooth: HIDP: reject frames without a transaction header'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: HIDP: reject frames without a transaction header

  hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]
  before checking that the L2CAP SDU cont…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    238c333bc4b3f245c626632e8bfa3c9dab97f51b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    567a2a0a633f2ea5fdccaf3517c09f22c9d860c7
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    97b61241ab45bfa5b0526cb0f3978942493bc811
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2ebf63aa557a69990b4e9ea22be224d58aabce96
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    854194494a6f726a60b90b76059148bf08df023d
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    47778d2c2087b5d192398f6fddf692d16a5431cf
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:58:35.164112Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:51.205Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74508'
references:
  - url: 'https://git.kernel.org/stable/c/24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8'
  - url: 'https://git.kernel.org/stable/c/238c333bc4b3f245c626632e8bfa3c9dab97f51b'
  - url: 'https://git.kernel.org/stable/c/567a2a0a633f2ea5fdccaf3517c09f22c9d860c7'
  - url: 'https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec'
  - url: 'https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811'
  - url: 'https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96'
  - url: 'https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d'
  - url: 'https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf'
tags:
  - cve.org
epss: 0.00262
epssPercentile: 0.16839
ingestedAt: '2026-10-16T19:46:24.354Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: reject frames without a transaction header

hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]
before checking that the L2CAP SDU contains a transaction header. A
connected HIDP peer can send an empty basic-mode SDU and make both paths
use an uninitialized byte from skb tailroom.

KMSAN reports the use in hidp_session_run(), with the uninitialized value
originating in __alloc_skb() through vhci_write(). The control path
produces two reports and the interrupt path produces one.

The byte can also be controlled by a malformed lower-layer packet. If an
HCI ACL packet contains an L2CAP PDU with a declared zero-length payload
followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to
the declared PDU length before dispatch. The current HIDP path nevertheless
consumes the extra byte as HIDP_TRANS_HID_CONTROL |
HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this
change, the same packet is discarded and a subsequent feature report
request succeeds.

Pull the transaction header with skb_pull_data() and discard frames that
do not contain it.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 24c64ccd5c1fc9934b427335b0d976c7f2b1a7d8`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 238c333bc4b3f245c626632e8bfa3c9dab97f51b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 567a2a0a633f2ea5fdccaf3517c09f22c9d860c7`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 97b61241ab45bfa5b0526cb0f3978942493bc811`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2ebf63aa557a69990b4e9ea22be224d58aabce96`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 854194494a6f726a60b90b76059148bf08df023d`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 47778d2c2087b5d192398f6fddf692d16a5431cf`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.