What is the CVSS score of CVE-2026-74508?

CVE-2026-74508 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74508?

A high-severity vulnerability in the Linux kernel Bluetooth HIDP subsystem (CVE-2026-74508, CVSS 8.8) allows unauthenticated adjacent attackers to disclose kernel memory and terminate active…. A patch is available.

How to fix or mitigate CVE-2026-74508?

Within 24 hours, identify all Linux systems actively using Bluetooth HID peripherals (wireless keyboards, mice, headsets). Within 7 days, apply the vendor-released patch via your Linux distribution's advisory-consult RHEL, Ubuntu, Debian, or other distribution security channels for the specific kernel version or update. Within 30 days, verify patch deployment across all systems in scope and monitor system logs for any Bluetooth-related errors prior to patching.

Linux Kernel CVE-2026-74508

EUVD-2026-59701 HIGH

2026-08-15 Linux

GHSA-39c4-67x8-fp8m

Information Disclosure Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Adjacent Bluetooth vector with no auth; I:N because only memory disclosure and session termination are demonstrated, not a write primitive.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 11:55 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:27 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:27 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: reject frames without a transaction header

hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom.

KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one.

The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds.

Pull the transaction header with skb_pull_data() and discard frames that do not contain it.

AnalysisAI

Uninitialized memory read and session hijack in the Linux kernel Bluetooth HIDP subsystem exposes systems with active Bluetooth HID sessions to kernel memory disclosure and forced session termination from an unauthenticated adjacent attacker. The functions hidp_recv_ctrl_frame() and hidp_recv_intr_frame() dereference skb->data[0] before validating that the received L2CAP SDU is at least one byte long, allowing a connected peer to feed an empty frame and cause the kernel to consume a stale tailroom byte - or, via a crafted HCI ACL packet, a fully attacker-controlled byte interpreted as a synthetic HIDP transaction code. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Enter Bluetooth range of target

Delivery

Establish HIDP L2CAP connection (no auth)

Exploit

Send empty SDU or crafted HCI ACL packet with zero-length L2CAP payload

Execution

Kernel reads uninitialized tailroom byte as HIDP transaction header

Persist

Disclose kernel memory byte or inject virtual cable unplug command

Impact

HIDP session terminated, Bluetooth HID devices disconnected

Access

Enter Bluetooth range of target

Delivery

Establish HIDP L2CAP connection (no auth)

Exploit

Send empty SDU or crafted HCI ACL packet with zero-length L2CAP payload

Execution

Kernel reads uninitialized tailroom byte as HIDP transaction header

Persist

Disclose kernel memory byte or inject virtual cable unplug command

Impact

HIDP session terminated, Bluetooth HID devices disconnected

Vulnerability AssessmentAI

Exploitation	The target system must have Bluetooth hardware present, the Bluetooth subsystem enabled (not rfkill-blocked), and the HIDP kernel module loaded (CONFIG_BT_HIDP=m or =y). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 score and High CIA ratings are partially justified but warrant scrutiny. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker within Bluetooth radio range of a target Linux system establishes an HIDP connection without requiring authentication (CVSS PR:N), then transmits either an empty L2CAP SDU in basic mode or a crafted HCI ACL packet with a declared zero-length L2CAP payload followed by a controlled trailing byte of 0x15. The kernel's HIDP receive path reads the uninitialized or attacker-placed byte as a transaction header and either discloses one byte of uninitialized kernel tailroom memory (information disclosure) or interprets 0x15 as HIDP_TRANS_HID_CONTROL \| HIDP_CTRL_VIRTUAL_CABLE_UNPLUG, immediately terminating the HIDP session and disconnecting Bluetooth input devices. …
Remediation	Apply the vendor-released kernel patches for the applicable stable branch: upgrade to Linux 6.6.151, 6.12.103, 6.18.44, or 7.1.8, referencing the upstream stable commits at https://git.kernel.org/stable/c/46ca5ab39737d7c6f9ca77ecf714cdcfa6caaeec (6.6 branch), https://git.kernel.org/stable/c/97b61241ab45bfa5b0526cb0f3978942493bc811 (6.12 branch), https://git.kernel.org/stable/c/2ebf63aa557a69990b4e9ea22be224d58aabce96 (6.18 branch), https://git.kernel.org/stable/c/854194494a6f726a60b90b76059148bf08df023d, and https://git.kernel.org/stable/c/47778d2c2087b5d192398f6fddf692d16a5431cf (7.1 branch). … Detailed patch versions, workarounds, and compensating controls in full report.