CVE-2026-74507: Bluetooth: HIDP: validate numbered report payloads

CVE-2026-74507: Bluetooth: HIDP: validate numbered report payloads

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: validate numbered report payloads

When hidp_get_raw_report() waits for a numbered report,
hidp_process_data() compares the expected report number with skb->data[0].
A connected HIDP peer can reply with only a DATA transaction header,
leaving the skb empty after the header is removed.

KMSAN reports an uninitialized-value use in hidp_session_run(), with the
value originating in __alloc_skb() through vhci_write(). The transaction
header checks remove the empty-frame reports, but this report remains until
the payload check is added.

The comparison can also consume a peer-controlled byte beyond the declared
L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made
the current code accept that byte as report ID 1 and complete
HIDIOCGFEATURE with a zero-byte result. With this change the malformed
response is rejected with -EIO, while a subsequent valid response still
succeeds.

Require a payload byte before comparing a numbered report ID. Unnumbered
reports continue to accept an empty payload.

The Linux kernel CVE team has assigned CVE-2026-74507 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.39 with commit 0ff1731a1ae51e8e48cd559d70db536281c47f8e and fixed in 6.6.151 with commit b7ad105d46acd828e424454815e4cd31069e047a
	Issue introduced in 2.6.39 with commit 0ff1731a1ae51e8e48cd559d70db536281c47f8e and fixed in 6.12.103 with commit 7e7162427659b70ea17cd41b1f79e2e64c246690
	Issue introduced in 2.6.39 with commit 0ff1731a1ae51e8e48cd559d70db536281c47f8e and fixed in 6.18.44 with commit 27cc0e603355c585f1e5da8398faa4d36d498188
	Issue introduced in 2.6.39 with commit 0ff1731a1ae51e8e48cd559d70db536281c47f8e and fixed in 7.1.8 with commit 9c841f59e10b5d75c398a3fc6b2da448d2a2276b
	Issue introduced in 2.6.39 with commit 0ff1731a1ae51e8e48cd559d70db536281c47f8e and fixed in 7.2-rc6 with commit 34f53d27b81a16a02828c8fdfa4e02badc326f17

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74507
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/hidp/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b7ad105d46acd828e424454815e4cd31069e047a
	https://git.kernel.org/stable/c/7e7162427659b70ea17cd41b1f79e2e64c246690
	https://git.kernel.org/stable/c/27cc0e603355c585f1e5da8398faa4d36d498188
	https://git.kernel.org/stable/c/9c841f59e10b5d75c398a3fc6b2da448d2a2276b
	https://git.kernel.org/stable/c/34f53d27b81a16a02828c8fdfa4e02badc326f17