CVE-2026-74507

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) component. A connected HIDP peer can send a malformed report with only a data transaction header, leading to the use of an uninitialized value in hidp_session_run(). This vulnerability could potentially result in a denial of service or information disclosure. Additionally, a peer-controlled byte beyond the declared L2CAP Protocol Data Unit (PDU) could be consumed, causing incorrect processing of HID feature requests.

A flaw of moderate severity was found in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) implementation, affecting Red Hat Enterprise Linux kernel packages. When the kernel waits for a numbered HID report, hidp_process_data() compares the expected report number with the first byte of the received skb payload. A malicious peer that is already connected to the system as a Bluetooth HIDP device can send a malformed report consisting only of a DATA transaction header; after the header is removed the skb is empty, and the kernel then reads an uninitialized value in hidp_session_run(). This can result in a kernel panic (denial of service) and potentially in limited information disclosure. The same missing validation also allows a peer-controlled byte beyond the declared L2CAP PDU to be consumed, so that a malformed DATA | FEATURE response can be accepted and complete an HIDIOCGFEATURE request with an invalid zero-byte result. Red Hat rates this flaw MODERATE, lower than the upstream CVE.org severity of 7.1 (Important), because exploitation requires the attacker to be an already-connected Bluetooth HIDP peer and the principal established consequence is denial of service rather than a reliable confidentiality or integrity compromise.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.