Look up another CVE · open CVE-2026-74508 in the interactive tracker
CVE-2026-74508
Bluetooth: HIDP: reject frames without a transaction header
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/bluetooth. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74508 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom. KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one. The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds. Pull the transaction header with skb_pull_data() and discard frames that do not contain it.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/bluetooth/hidp/core.c
- What this is
- BLUETOOTH SUBSYSTEMMAINTAINERS section matched on net/bluetooth/ · linux-bluetooth@vger.kernel.org · Supported
- Kernel module
- hidp
Check it on the machine
grep -wE 'CONFIG_BT|CONFIG_BT_HIDP' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w hidpPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookwormMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64, s390x/s390x
- bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switches
- CONFIG_BT, CONFIG_BT_HIDP
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.8 high
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- adjacent network (AV:A)source
- EPSS
- 0.26%, higher than 16.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/bluetooth
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 2.6.12 | 5.10.266 | 24c64ccd5c1f |
| 2.6.12 | 5.15.216 | 238c333bc4b3 |
| 2.6.12 | 6.1.183 | 567a2a0a633f |
| 2.6.12 | 6.6.151 | 46ca5ab39737 |
| 2.6.12 | 6.12.103 | 97b61241ab45 |
| 2.6.12 | 6.18.44 | 2ebf63aa557a |
| 2.6.12 | 7.1.8 | 854194494a6f |
| 2.6.12 | 7.2 | 47778d2c2087 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:AAttack vector, adjacent network
- Malicious or malformed Bluetooth L2CAP SDUs reach hidp_recv_ctrl_frame()/hidp_recv_intr_frame() from a radio-adjacent peer via hci_acl_packet() -> l2cap_recv_acldata() -> l2cap_recv_frame() -> l2cap_sock_recv_cb() -> hidp_session_run().
- AC:LAttack complexity, low
- A connected HIDP peer reliably triggers the bug by sending empty basic-mode SDUs or zero-length L2CAP PDUs with trailing bytes; the attacker controls both sides of the malformed-packet condition without races or rare kernel configs.
- PR:NPrivileges required, none
- Exploitation requires only delivering crafted Bluetooth ACL/L2CAP traffic as the connected peer; the victim attacker does not need local accounts, capabilities, or CAP_NET_ADMIN on the target host.
- UI:NUser interaction, none
- Once a normal Bluetooth HID session is active (typical paired keyboard/mouse/headset use), the attacker can send malicious frames without any additional victim interaction during exploitation.
- S:UScope, unchanged
- The flaw affects kernel Bluetooth HIDP session handling only and does not cross VM, container, or IOMMU security boundaries; impact stays within the kernel Bluetooth/HID authority.
- C:HConfidentiality impact, high
- On zero-length SDUs, hidp_recv_*_frame() reads skb->data[0] from uninitialized skb tailroom (KMSAN via vhci_write/__alloc_skb), leaking kernel heap bytes that drive subsequent protocol parsing.
- I:HIntegrity impact, high
- Attacker-controlled header bytes (e.g., malformed PDU trailing 0x15 = HIDP_TRANS_HID_CONTROL|HIDP_CTRL_VIRTUAL_CABLE_UNPLUG) force hidp_process_hid_control() to tear down sessions and can misroute other transaction types through handshake/data handlers.
- A:HAvailability impact, high
- Forged virtual-cable-unplug and related control-path handling forcibly terminates active HIDP sessions, completely denying Bluetooth HID input/output on phones, laptops, kiosks, and embedded systems until reconnect.