CVE-2026-63947: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-63947 Overview

CVE-2026-63947 is an out-of-bounds read vulnerability in the Linux kernel's Bluetooth Human Interface Device Protocol (HIDP) subsystem. The flaw resides in the hidp_input_report() function, which reads keyboard and mouse payload data from a socket buffer (skb) without verifying that skb->len contains sufficient data. A paired Bluetooth device can send a truncated packet that causes the handler to read beyond valid skb data. Out-of-bounds bytes may be interpreted as phantom key presses or spurious mouse movement, injecting attacker-influenced input events into the host system.

Critical Impact
An adjacent-network attacker with an established Bluetooth pairing can trigger out-of-bounds reads in the kernel, potentially injecting synthetic input events or destabilizing the affected system.

Affected Products

Linux kernel Bluetooth HIDP subsystem (multiple stable branches)
Distributions shipping affected kernel versions prior to the referenced fix commits
Systems with Bluetooth HID pairing enabled

Discovery Timeline

2026-07-19 - CVE-2026-63947 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-63947

Vulnerability Analysis

The vulnerability affects hidp_input_report() in the Linux kernel Bluetooth HIDP stack. The function processes HID input reports delivered over the Bluetooth interrupt channel and dispatches keyboard and mouse payloads to the input subsystem. Before parsing, hidp_recv_intr_frame() pulls the 1-byte HIDP header from the incoming skb and forwards the remaining buffer to hidp_input_report().

The handler then reads payload bytes from the skb without validating that skb->len covers the fixed-size keyboard or mouse report structure. When a paired peripheral transmits a truncated packet, the parser dereferences memory past the valid skb data region. This out-of-bounds read is classified as an Out-of-Bounds Read weakness and delivers uninitialized or adjacent bytes into the input pipeline.

Root Cause

The root cause is missing length validation combined with open-coded pointer arithmetic in the report parser. The original implementation tracked payload boundaries manually and lacked a guard comparing the required report size against skb->len. The upstream fix replaces the ad-hoc length tracking with skb_pull_data() calls, which return NULL when the requested number of bytes is not present in the buffer, eliminating both the manual size variable and the missing skb->len guard.

Attack Vector

Exploitation requires the attacker to control or impersonate a Bluetooth device already paired with the target. Once the HIDP interrupt channel is established, the attacker sends a truncated HID report frame. The kernel pulls the 1-byte header, then invokes hidp_input_report() on a payload shorter than the expected keyboard or mouse structure. The parser reads past the buffer, and any adjacent memory is treated as report data. Because injected values propagate through the input subsystem, they can appear to userspace as legitimate key presses or pointer motion originating from a trusted HID peripheral.

No public exploit or proof-of-concept has been published for CVE-2026-63947 at the time of writing. Technical details of the fix are available in the referenced Linux Kernel Commits.

Detection Methods for CVE-2026-63947

Indicators of Compromise

Unexpected HID input events (key presses, cursor movement) originating from paired Bluetooth devices without physical user interaction.
Kernel log entries referencing hidp with malformed or short-frame processing on affected kernel versions.
Newly paired or re-paired Bluetooth HID devices immediately preceding anomalous input activity.

Detection Strategies

Inventory endpoints against installed kernel version and compare with fixed stable branches referenced in the kernel commits.
Enable KASAN or kernel address sanitizer builds in test environments to surface out-of-bounds reads in hidp_input_report() during fuzzing.
Correlate Bluetooth pairing events with subsequent input device registrations in system logs.

Monitoring Recommendations

Monitor dmesg and journalctl for Bluetooth stack errors, HIDP frame anomalies, and unexpected input subsystem registrations.
Audit paired Bluetooth device lists on managed endpoints and flag additions outside of change-control windows.
Track Bluetooth adapter power state and discoverability configuration across the fleet to reduce exposure surface.

How to Mitigate CVE-2026-63947

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution that include the skb_pull_data() refactor in hidp_input_report().
Disable the Bluetooth service or HID profile on systems that do not require wireless keyboards or mice.
Unpair unknown or unused Bluetooth HID devices from all endpoints.
Restrict Bluetooth discoverability to reduce the ability of adjacent attackers to establish pairings.

Patch Information

The fix is available in multiple Linux stable branches. Refer to the upstream commits: 1f08a900, 2a3ac9ee, 6348dfed, b83dcacd, cc3832b1, d313683d, and d7d6a81b. Consult your distribution's security advisories for backported package versions.

Workarounds

Unload the hidp and bluetooth kernel modules on systems that do not require Bluetooth HID functionality.
Blocklist the hidp module via /etc/modprobe.d/ to prevent automatic loading at boot.
Enforce a Bluetooth allowlist policy that only permits known, trusted peripheral MAC addresses to pair.

bash

# Configuration example
# Disable Bluetooth HID Protocol module loading
echo "blacklist hidp" | sudo tee /etc/modprobe.d/disable-hidp.conf
echo "blacklist bluetooth" | sudo tee -a /etc/modprobe.d/disable-hidp.conf

# Stop and disable the Bluetooth service on systems that do not need it
sudo systemctl stop bluetooth.service
sudo systemctl disable bluetooth.service

# Verify current kernel version against fixed stable branches
uname -r