CVE-2026-74507

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth HIDP (HID over SDP) implementation where the hidp process data() function fails to validate the payload of numbered reports. When hidp get raw report() waits for a numbered report, the system compares the expected report number with skb->data[0]. A connected HIDP peer can send only a DATA transaction header, leaving the socket buffer (skb) empty. This leads to an uninitialized-value use in hidp session run(), with the value originating in alloc skb() through vhci write(). Additionally, the comparison can consume a peer-controlled byte beyond the declared L2CAP PDU (Protocol Data Unit), potentially causing the system to accept malformed responses as valid report IDs and completing HIDIOCGFEATURE with a zero-byte result.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.