CVE-2026-63947

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds read exists in the Bluetooth HIDP component. The hidp input report() function processes keyboard and mouse payload data from an skb (socket buffer) without verifying if skb->len contains sufficient data. When a paired device sends a truncated packet, the handler reads beyond the valid data, which may be interpreted as phantom key presses or spurious mouse movement.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.