What is the CVSS score of CVE-2026-74507?

CVE-2026-74507 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74507?

A Linux kernel vulnerability in Bluetooth HID processing allows adjacent attackers to extract sensitive kernel memory and potentially bypass security protections (KASLR).. A patch is available.

How to fix or mitigate CVE-2026-74507?

Within 24 hours, identify and catalogue all Linux systems with active Bluetooth HID device sessions, particularly production servers and endpoints supporting wireless peripherals. Within 7 days, apply the available vendor-released patch to all affected systems, prioritizing critical infrastructure and production environments. Within 30 days, complete verification of patch deployment across the entire inventory, document patching records for compliance, and conduct post-deployment validation testing.

Linux Kernel CVE-2026-74507

EUVD-2026-59700 HIGH

2026-08-15 Linux

GHSA-m9hx-hxv2-v7fm

Information Disclosure Linux Red Hat Suse

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Adjacent vector reflects Bluetooth-range requirement; PR:N because the attacking peer device requires no authentication to the Linux host kernel.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

SUSE

5.4 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:55 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

7.1 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 7.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: validate numbered report payloads

When hidp_get_raw_report() waits for a numbered report, hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply with only a DATA transaction header, leaving the skb empty after the header is removed.

KMSAN reports an uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until the payload check is added.

The comparison can also consume a peer-controlled byte beyond the declared L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed response is rejected with -EIO, while a subsequent valid response still succeeds.

Require a payload byte before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.

AnalysisAI

Bluetooth HIDP in the Linux kernel exposes an uninitialized-memory read and a peer-controlled out-of-bounds byte access in hidp_session_run() when processing numbered HID report responses. Systems running Linux with active Bluetooth HID sessions are vulnerable to a malicious adjacent Bluetooth peer leveraging this to disclose kernel memory contents (rated C:H, enabling potential KASLR bypass) or manipulate HIDIOCGFEATURE report completion with attacker-controlled data. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Approach within Bluetooth radio range

Delivery

Establish HIDP peer session with target system

Exploit

Trigger userspace HIDIOCGFEATURE ioctl to initiate numbered report wait

Execution

Send empty or malformed DATA transaction response

Persist

Read uninitialized kernel memory via empty skb

Impact

Disclose kernel memory contents or manipulate report completion

Access

Approach within Bluetooth radio range

Delivery

Establish HIDP peer session with target system

Exploit

Trigger userspace HIDIOCGFEATURE ioctl to initiate numbered report wait

Execution

Send empty or malformed DATA transaction response

Persist

Read uninitialized kernel memory via empty skb

Impact

Disclose kernel memory contents or manipulate report completion

Vulnerability AssessmentAI

Exploitation	The attacker must be within Bluetooth radio range (typically 10-100 meters depending on device class) and must establish a valid HIDP session with the target system - requiring either successful Bluetooth pairing, session hijacking, or a spoofed device that the target accepts. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.1 High (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) correctly reflects that the attack vector is Adjacent (Bluetooth radio range), a meaningful real-world constraint compared to fully network-accessible flaws. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker within Bluetooth radio range connects a malicious or spoofed Bluetooth HID device to the target Linux system, establishing an HIDP session. Once connected, the attacker sends a crafted DATA transaction response containing only the transaction header and no payload bytes, triggering the uninitialized-memory read in hidp_session_run() and potentially leaking kernel memory contents including addresses useful for KASLR bypass. …
Remediation	The primary remediation is upgrading to a patched Linux kernel: 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2-rc6 (or later), available via the kernel.org stable commits referenced above. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify and catalogue all Linux systems with active Bluetooth HID device sessions, particularly production servers and endpoints supporting wireless peripherals. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-74507 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74507

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code