CVE-2026-74508

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth HIDP implementation where the functions hidp recv ctrl frame() and hidp recv intr frame() read skb->data[0] before verifying that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU, causing both paths to use an uninitialized byte from the skb tailroom. This uninitialized value originates in alloc skb() through vhci write() and is reported in hidp session run(). Additionally, a malformed lower-layer packet containing an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte can cause the HIDP path to consume the extra byte as a virtual cable unplug event, resulting in the termination of the HIDP session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.