Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: reject frames without a transaction header hidp_recv_ctrl_frame() and hidp_recv_intr_frame() read skb->data[0] before checking that the L2CAP SDU contains a transaction header. A connected HIDP peer can send an empty basic-mode SDU and make both paths use an uninitialized byte from skb tailroom. KMSAN reports the use in hidp_session_run(), with the uninitialized value originating in __alloc_skb() through vhci_write(). The control path produces two reports and the interrupt path produces one. The byte can also be controlled by a malformed lower-layer packet. If an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra 0x15 byte, l2cap_recv_acldata() reduces skb->len to the declared PDU length before dispatch. The current HIDP path nevertheless consumes the extra byte as HIDP_TRANS_HID_CONTROL | HIDP_CTRL_VIRTUAL_CABLE_UNPLUG and terminates the HIDP session. With this change, the same packet is discarded and a subsequent feature report request succeeds. Pull the transaction header with skb_pull_data() and discard frames that do not contain it.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:17:55.843Z",
  "pubdate": "2026-08-15T13:17:55.843Z",
  "executiveSummary": "A vulnerability exists within the Linux kernel Bluetooth subsystem's Human Interface Device Protocol (HIDP) implementation, specifically affecting frame reception paths. The vulnerability manifests as an out-of-bounds read and improper input validation, categorized as a missing validation of input length leading to the use of uninitialized memory. An authenticated or adjacent Bluetooth peer can exploit this flaw by transmitting specially crafted or empty frames, such as an empty basic-mode L2CAP SDU or a malformed lower-layer packet. Successful exploitation allows a remote attacker to trigger kernel usage of uninitialized bytes from the socket buffer (skb) tailroom, potentially resulting in kernel information disclosure, erratic protocol state behavior, or unintended denial of service via forced session termination. Exploitation requires proximity to the vulnerable Bluetooth interface and the ability to establish a connected HIDP session or inject low-layer packets. Mitigation requires applying kernel patches that enforce strict validation of transaction headers using skb_pull_data() to discard malformed frames prior to data processing.",
  "technicalDetails": "The vulnerability resides in the Bluetooth HIDP implementation within the Linux kernel, specifically impacting the hidp_recv_ctrl_frame() and hidp_recv_intr_frame() functions located in the network stack paths handling control and interrupt frames. The root cause of the vulnerability is the lack of boundary validation before reading the first byte of data from the socket buffer (skb->data[0]). Specifically, the functions attempt to read the transaction header before verifying that the underlying L2CAP SDU contains sufficient length to encompass the header byte.\nDuring normal execution, KMSAN reports that an uninitialized value originates from __alloc_skb() via vhci_write() when handling empty basic-mode SDUs. Because the L2CAP SDU is empty, the read operation accesses uninitialized memory within the skb tailroom. Furthermore, malformed lower-layer packets can manipulate this condition. For instance, if an HCI ACL packet contains an L2CAP PDU with a declared zero-length payload followed by an extra byte (such as 0x15), l2cap_recv_acldata() truncates the skb->len to match the declared PDU length. Despite this truncation, the legacy HIDP parsing path consumes the trailing extra byte as a valid HIDP transaction header—specifically interpreted as HIDP_TRANS_HID_CONTROL combined with HIDP_CTRL_VIRTUAL_CABLE_UNPLUG—which prematurely terminates the active HIDP session.\nThe attack flow proceeds as follows: 1) An attacker establishes a valid Bluetooth HIDP connection with the target system or injects a malformed lower-layer HCI ACL packet containing a zero-length L2CAP payload with trailing bytes. 2) The lower-layer protocol handler l2cap_recv_acldata() processes the packet, reducing skb->len to zero while leaving the extra byte in the buffer tailroom. 3) The packet is dispatched to hidp_recv_ctrl_frame() or hidp_recv_intr_frame(). 4) Without verifying the availability of a transaction header, the functions read skb->data[0], consuming uninitialized memory or the trailing malformed byte. 5) The kernel acts upon the parsed control data, leading to unauthorized state transitions, potential information leaks via kernel logs or responses, and unauthorized session teardowns. The vulnerability requires local network proximity to the Bluetooth adapter and a connected HIDP session or malicious HCI packet injection capability."
}