The Linux kernel's Bluetooth HIDP input report handler (hidp_input_report()) lacked proper length validation before reading data from skb buffers. Specifically, if a paired Bluetooth device sent a truncated packet, the handler would read beyond the valid skb data, causing an out-of-bounds read. This could result in phantom key presses or spurious mouse movements. The fix involved replacing manual pointer arithmetic and length tracking with calls to skb_pull_data(), which returns NULL if the requested bytes are not available, preventing out-of-bounds access.

An attacker controlling a paired Bluetooth HID device could send malformed truncated packets causing the kernel to read beyond valid memory bounds. This may lead to incorrect input events such as phantom key presses or mouse movements. There is no indication of code execution or privilege escalation from this vulnerability based on the available data.

A fix for this vulnerability has been implemented in the Linux kernel by modifying the hidp_input_report() function to use skb_pull_data() for safer length checks. Users and administrators should apply the official kernel updates that include this fix. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation guidance.