{"id":"CVE-2026-43023","revision":"b5287bb352dc4919bf6720d6692a4310","records":[{"revision":"b5287bb352dc4919bf6720d6692a4310","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43023","aliases":[],"title":"Bluetooth: SCO: fix race conditions in sco_sock_connect()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n  Thread A (connect):    HCI disconnect:      Thread B (connect):\n\n  sco_sock_connect(sk)                        sco_sock_connect(sk)\n  sk_state==BT_OPEN                           sk_state==BT_OPEN\n  (pass, no lock)                             (pass, no lock)\n  sco_connect(sk):                            sco_connect(sk):\n    hci_dev_lock                                hci_dev_lock\n    hci_connect_sco                               <- blocked\n      -> hcon1\n    sco_conn_add->conn1\n    lock_sock(sk)\n    sco_chan_add:\n      conn1->sk = sk\n      sk->conn = conn1\n    sk_state=BT_CONNECT\n    release_sock\n    hci_dev_unlock\n                           hci_dev_lock\n                           sco_conn_del:\n                             lock_sock(sk)\n                             sco_chan_del:\n                               sk->conn=NULL\n                               conn1->sk=NULL\n                               sk_state=\n                                 BT_CLOSED\n                               SOCK_ZAPPED\n                             release_sock\n                           hci_dev_unlock\n                                                  (unblocked)\n                                                  hci_connect_sco\n                                                    -> hcon2\n                                                  sco_conn_add\n                                                    -> conn2\n                                                  lock_sock(sk)\n                                                  sco_chan_add:\n                                                    sk->conn=conn2\n                                                  sk_state=\n                                                    BT_CONNECT\n                                                  // zombie sk!\n                                                  release_sock\n                                                  hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n  sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n  return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n  to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n  double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n  HCI connection leaks","state":0,"publishedAt":"2026-05-01T14:15:25.736+00:00","modifiedAt":"2026-10-19T19:06:09.917+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"70a13b1e25fef37c87c8a1228ddb8900efbca7cf\",\n                            \"lessThan\": \"dabf22269242e2f2bf44c43fcdc2fa763df7f9cc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\n                            \"lessThan\": \"adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\n                            \"lessThan\": \"7e296ffdab5bdab718dff7c14288fdcb9154fa27\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\n                            \"lessThan\": \"98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\n                            \"lessThan\": \"d002bd11024bd231bcb606877e33951ffb7bed14\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\n                            \"lessThan\": \"8a5b0135d4a5d9683203a3d9a12a711ccec5936b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.1.109\",\n                            \"lessThan\": \"6.1.168\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.3\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.168\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.134\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.81\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.22\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.12\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc","https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0","https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27","https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d","https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14","https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43023","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43023","identifiers":["CVE-2026-43023"]},"retained":false,"historicalAffected":[]}],"coverage":[]}