{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-63947", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.023Z", "datePublished": "2026-07-19T14:55:41.306Z", "dateUpdated": "2026-08-05T12:37:34.167Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:37:34.167Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: HIDP: fix missing length checks in hidp_input_report()\n\nhidp_input_report() reads keyboard and mouse payload data from an skb\nwithout first verifying that skb->len contains enough data.\n\nhidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching\nto hidp_input_report(). If a paired device sends a truncated packet,\nthe handler reads beyond the valid skb data, resulting in an\nout-of-bounds read of skb data. The OOB bytes may be interpreted as\nphantom key presses or spurious mouse movement.\n\nReplace the open-coded length tracking and pointer arithmetic with\nskb_pull_data() calls. skb_pull_data() returns NULL if the requested\nbytes are not present, eliminating the need for a manual size variable\nand the separate skb->len guard." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:A - The bug is reached when a connected Bluetooth HID peer sends malformed HIDP interrupt (or control DATA) frames over L2CAP ACL; packets traverse HCI → l2cap_recv_acldata() → l2cap_data_channel() → l2cap_sock_recv_cb() → HIDP session thread → hidp_recv_intr_frame()/hidp_process_data() → hidp_input_report(), which is an adjacent Bluetooth attack surface.\nAC:L - Exploitation only requires sending deliberately truncated HIDP input reports on an already-established HIDP/L2CAP session; the attacker fully controls packet length and can trigger the out-of-bounds read reliably on every malformed frame with no race or special memory layout.\nPR:N - The attacker is an external Bluetooth HID device sending L2CAP payloads and needs no Linux account, capability, or namespace privilege; CAP_NET_ADMIN is only required for bluetoothd to register the session, not for the malicious peer to deliver the crafted packets.\nUI:N - Once a HIDP session is active, exploitation is automatic from crafted Bluetooth traffic and requires no further victim action; pairing/connection is an attacker prerequisite, not user interaction at exploit time (consistent with prior Bluetooth HIDP CNA scoring such as CVE-2026-23462).\nS:U - Impact is confined to kernel HIDP/input handling and forged input events delivered within the same kernel security authority; it does not cross a VM, IOMMU, or sandbox boundary.\nC:H - The vulnerable code performs out-of-bounds reads of up to eight keyboard or four mouse payload bytes beyond skb->len, and per CVSS kernel guidance any out-of-bounds read is rated High because adjacent skb tailroom may contain stale packet or kernel heap data observable through phantom key/mouse event side channels.\nI:H - Out-of-bounds bytes are interpreted as boot-protocol keyboard scancodes and mouse button/movement events, enabling phantom key presses and pointer injection into the system input layer; on laptops, kiosks, automotive consoles, and Android handsets this can forge arbitrary keystrokes/clicks against the active user session.\nA:H - Reading keyboard/mouse payload bytes past valid skb->len is undefined behavior on tightly allocated skbs with no tailroom and can fault the kernel; even when reads stay within tailroom, forged input can repeatedly disrupt session availability on shared/public Bluetooth keyboard deployments, and under the conservative scoring rule this is rated High when crash potential cannot be excluded." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hidp/core.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1f08a90013e1e632b34321334e861fcefc056505", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "cc3832b19f863e3677c5651f001a2e3795f39eb8", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d313683d6ccdd8c01e0562270a2ae25b86d8461d", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d7d6a81b8dd1a8d084a1b755db9406041d53adb5", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "6348dfed5b0f9c6074f14322332e97493d32fef0", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b83dcacd2ec7fcc5a48be215f82d573759f87ec2", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/bluetooth/hidp/core.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.210" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.176" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.143" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.12.93" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.18.35" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.0.12" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505" }, { "url": "https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8" }, { "url": "https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d" }, { "url": "https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5" }, { "url": "https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0" }, { "url": "https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2" }, { "url": "https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6" } ], "title": "Bluetooth: HIDP: fix missing length checks in hidp_input_report()", "x_generator": { "engine": "bippy-1.2.0" } } } }