CVE-2026-74508

A flaw was found in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) implementation. A connected HIDP peer can send specially crafted Bluetooth packets that cause the system to read uninitialized memory. This can lead to a denial of service by terminating the HIDP session.

Bluetooth HIDP control and interrupt receive paths read the first byte of skb data before verifying that the L2CAP SDU contains a HIDP transaction header. A connected HIDP peer can send an empty basic mode SDU and make the kernel consume an uninitialized byte from skb tailroom. A malformed lower layer Bluetooth packet can also place an extra byte after a declared zero length L2CAP payload, which may be interpreted as a HIDP virtual cable unplug command and terminate the HIDP session. For the CVSS the PR:N is used because exploitation does not require local privileges on the victim once the attacker can act as a connected Bluetooth HIDP peer or inject the malformed adjacent Bluetooth traffic. The issue is adjacent network reachable rather than Internet reachable. Impact is primarily denial of service against the HIDP session.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.