The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: HIDP: validate numbered report payloads When hidp_get_raw_report() waits for a numbered report,     hidp_process_data() compares the expected report number with skb->data[0]. A connected HIDP peer can reply     with only a DATA transaction header, leaving the skb empty after the header is removed. KMSAN reports an     uninitialized-value use in hidp_session_run(), with the value originating in __alloc_skb() through     vhci_write(). The transaction header checks remove the empty-frame reports, but this report remains until     the payload check is added. The comparison can also consume a peer-controlled byte beyond the declared     L2CAP PDU. A DATA | FEATURE response followed by an extra 0x01 byte made the current code accept that byte     as report ID 1 and complete HIDIOCGFEATURE with a zero-byte result. With this change the malformed     response is rejected with -EIO, while a subsequent valid response still succeeds. Require a payload byte     before comparing a numbered report ID. Unnumbered reports continue to accept an empty payload.
    (CVE-2026-74507)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-74507

high Nessus Plugin ID 335773

Version 1.3