CVE-2026-74508 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: HIDP: reject frames without a transaction header
hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0]
before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom.
KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one.
The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds.
Pull the transaction header with skb_pull_data() and discard frames that do not contain it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists in the Linux kernel's Bluetooth HIDP (Human Interface Device Profile) implementation where the hidp_recv_ctrl_frame() and hidp_recv_intr_frame() functions fail to validate the presence of a transaction header before accessing the first byte of the skb->data buffer. The flaw occurs when a connected HIDP peer sends an empty basic-mode SDU that lacks a proper transaction header, causing both code paths to read from uninitialized memory within the skb tailroom. This represents a classic buffer overread vulnerability that can lead to information disclosure or potential exploitation through uninitialized data consumption.
The technical execution of this vulnerability involves multiple layers of the Bluetooth stack where KMSAN (Kernel Memory Sanitizer) detects the use of uninitialized values originating from __alloc_skb() through vhci_write(). The control path generates two reports while the interrupt path produces one, indicating that both code paths are susceptible to reading uninitialized memory. The specific issue manifests when l2cap_recv_acldata() processes HCI ACL packets containing L2CAP PDUs with zero-length payloads followed by extra bytes, which causes the kernel to consume these additional bytes as HIDP transaction headers despite their invalid nature.
This vulnerability directly maps to CWE-457: Use of Uninitialized Variable and potentially relates to CWE-125: Out-of-Bounds Read in the context of kernel memory management. The operational impact includes information disclosure through uninitialized memory access, potential session termination due to malformed packet handling, and possible denial of service conditions. Attackers could exploit this by crafting specific HCI ACL packets that trigger the uninitialized memory read scenario, potentially leading to privilege escalation or system instability. The vulnerability affects systems running Linux kernels with Bluetooth HIDP support where remote attackers can establish HIDP connections.
The recommended mitigation involves implementing proper frame validation before accessing transaction header data by pulling the transaction header with skb_pull_data() and discarding frames that do not contain valid headers. This approach aligns with ATT&CK technique T1068: Exploitation for Privilege Escalation by preventing exploitation of uninitialized memory vulnerabilities. The fix ensures that all HIDP frames undergo proper validation before any data access occurs, eliminating the possibility of reading from uninitialized memory regions while maintaining proper protocol handling for legitimate frames. This defensive programming approach prevents attackers from leveraging uninitialized memory reads to gain unauthorized access or cause system instability through crafted Bluetooth HIDP packets.