Executive brief
A vulnerability in the Linux kernel's Bluetooth subsystem could allow a nearby paired device to trigger unexpected behavior. By sending specially crafted, shortened data packets, a device could cause the system to misinterpret random memory as keyboard presses or mouse movements. This could lead to unauthorized input or system instability on devices using Bluetooth peripherals.
Technical details
An out-of-bounds read exists in the hidp_input_report() function within net/bluetooth/hidp/core.c. The vulnerability occurs because the code reads keyboard and mouse payload data from a socket buffer (skb) without verifying that the buffer contains sufficient data after the 1-byte HIDP header is pulled. An attacker using a paired Bluetooth device can transmit truncated HIDP frames, causing the kernel to read adjacent memory. This out-of-bounds data is then processed as input, leading to 'phantom' key presses or mouse movements. The fix replaces manual pointer arithmetic with skb_pull_data() to ensure proper bounds checking.
Affected products
- Linux Linux Kernel 2.6.12 to 6.9.x
Timeline
- 2026-05-20: other: Patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505
- https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6
- https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0
- https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2
- https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8
- https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d
- https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5