Riskcovery

CVE-2026-31408

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

State
Published
Severity
8.8 High
Published
Apr 6, 2026
Updated
Oct 19, 2026
Reserved
Mar 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free.

Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock.

Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

Scores

CVSSScoreVectorSource
3.18.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

Affected Products

ProductVersions
LinuxLinux
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 37e18bc8c9a70d77bd099e2273f328b3bc7f6d0dAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d57384e27d1ebf0047e3f00a6e1181b8be9857a2Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b0a7da0e3f7442545f071499beb36374714bb9deAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 45aaca995e4a7a05b272a58e7ab2fff4f611b8f1Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 108b81514d8f2535eb16651495cefb2250528db3Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7197462e90b8ce15caa1ae15d4bc2bb8cd21b11eAffected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before e76e8f0581ef555eacc11dbb095e602fb30a5361Affected
  • 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 598dbba9919c5e36c54fe1709b557d64120cb94bAffected
LinuxLinux
  • 2.6.12Affected
  • before 2.6.12Not affected
  • 5.10.265 through 5.10.*Not affected
  • 5.15.203 through 5.15.*Not affected
  • 6.1.168 through 6.1.*Not affected
  • 6.6.131 through 6.6.*Not affected
  • 6.12.80 through 6.12.*Not affected
  • 6.18.21 through 6.18.*Not affected
  • 6.19.11 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.