What is the CVSS score of EUVD-2026-45720?

EUVD-2026-45720 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45720?

CVE-2026-63947 is a Linux kernel vulnerability affecting Bluetooth input device handling that allows unauthorized command injection and information leakage from paired wireless peripherals.. A patch is available.

How to fix or mitigate EUVD-2026-45720?

Within 24 hours, identify all Linux systems with Bluetooth input device support and classify by deployment context (corporate endpoints, BYOD, remote workers). Within 7 days, deploy vendor-released patches to staging and non-production systems, confirming input device functionality. Complete production deployment within 30 days, prioritizing critical systems and security-sensitive zones.

Linux Kernel EUVD-2026-45720

| CVE-2026-63947 HIGH

2026-07-19 Linux

GHSA-j4pv-6p78-8g93

Buffer Overflow Linux

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.2 MEDIUM

Bluetooth adjacency gives AV:A; requiring an already-paired peer plus a truncation race raises AC:H; effect is phantom input and a minor OOB read, so C:N/I:L/A:L rather than the vendor's high impacts.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:30 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: HIDP: fix missing length checks in hidp_input_report()

hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data.

hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement.

Replace the open-coded length tracking and pointer arithmetic with skb_pull_data() calls. skb_pull_data() returns NULL if the requested bytes are not present, eliminating the need for a manual size variable and the separate skb->len guard.

AnalysisAI

Out-of-bounds read in the Linux kernel Bluetooth HIDP (Human Interface Device Protocol) subsystem lets a paired, malicious Bluetooth peripheral send a truncated interrupt frame that hidp_input_report() parses without validating skb->len, causing the handler to read past valid skb data. The stale bytes are interpreted as phantom keystrokes or spurious mouse movement, giving an adjacent attacker a limited local input-injection/info-leak primitive. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a niche Bluetooth-range issue rather than mass exploitation; a vendor patch is available across multiple stable branches.

Technical ContextAI

The flaw lives in net/bluetooth/hidp/core.c. hidp_recv_intr_frame() strips the 1-byte HIDP header and dispatches to hidp_input_report(), which reads keyboard and mouse report payloads using open-coded pointer arithmetic and a manual length variable instead of confirming the socket buffer actually holds the expected bytes. Because the guard on skb->len is missing, a short frame drives reads beyond the buffer - a classic out-of-bounds read (CWE-125), even though the intelligence tags label it more loosely as 'Buffer Overflow'. The upstream fix replaces the hand-rolled length tracking with skb_pull_data(), which returns NULL when the requested bytes are absent, structurally removing the unchecked-length path. The affected component is the mainline/stable Linux kernel (CPE cpe:2.3:a:linux:linux) and the HIDP path is only reachable when Bluetooth HID connections are in use.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 (or later on the matching branch) - then reboot; the patched commits are at https://git.kernel.org/stable/ (e.g. https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505) and the issue is tracked at https://nvd.nist.gov/vuln/detail/CVE-2026-63947. Where immediate patching is not possible, compensating controls target the Bluetooth attack surface: unload and blacklist the hidp kernel module (modprobe -r hidp; add to /etc/modprobe.d) if Bluetooth HID peripherals are not needed, which fully removes the code path but breaks Bluetooth keyboards/mice; disable the Bluetooth stack entirely (rfkill block bluetooth or systemctl disable bluetooth) on hosts that do not require it, at the cost of all Bluetooth functionality; and prune untrusted paired devices, since exploitation requires an already-paired peer - remove unknown pairings and avoid pairing with untrusted peripherals to shrink the reachable attacker set.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-45720 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45720

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code