CVE-2026-63947 (CVSS 8.8)

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement. Replace the open-coded length tracking and pointer arithmetic with skb_pull_data() calls. skb_pull_data() returns NULL if the requested bytes are not present, eliminating the need for a manual size variable and the separate skb->len guard.

Is your site exposed to CVE-2026-63947?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0034

Probability of exploitation

0.26%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/1f08a90013e1e632b34321334e861fcefc056505 https://git.kernel.org/stable/c/2a3ac9ee11dbb9845f3947cef4a79dba658cf6f6 https://git.kernel.org/stable/c/6348dfed5b0f9c6074f14322332e97493d32fef0 https://git.kernel.org/stable/c/b83dcacd2ec7fcc5a48be215f82d573759f87ec2 https://git.kernel.org/stable/c/cc3832b19f863e3677c5651f001a2e3795f39eb8 https://git.kernel.org/stable/c/d313683d6ccdd8c01e0562270a2ae25b86d8461d https://git.kernel.org/stable/c/d7d6a81b8dd1a8d084a1b755db9406041d53adb5

Frequently Asked Questions

What is CVE-2026-63947? +

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidp_input_report() hidp_input_report() reads keyboard and mouse payload data from an skb without first verifying that skb->len contains enough data. hidp_recv_intr_frame() pulls the 1-byte HIDP header before dispatching to hidp_input_report(). If a paired device sends a truncated packet, the handler reads beyond the valid skb data, resulting in an out-of-bounds read of skb data. The OOB bytes may be interpreted as phantom key presses or spurious mouse movement. Replace the open-coded length tracking and pointer arithmetic with skb_pull_data() calls. skb_pull_data() returns NULL if the requested bytes are not present, eliminating the need for a manual size variable and the separate skb->len guard. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-63947? +

CVE-2026-63947 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0034, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-63947? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

CVE-2026-63947