{"id":"CVE-2026-99011","revision":"3f4376b7688b4442bbe5ab6dad349d12","records":[{"revision":"3f4376b7688b4442bbe5ab6dad349d12","observedAt":"2026-10-24T16:17:04.479+00:00","statement":{"source":"cve-program","id":"CVE-2026-99011","aliases":[],"title":"Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()\n\nsco_recv_scodata() upgrades the weak hcon->sco_data back-pointer to a\nstrong reference under hdev->lock:\n\n    hci_dev_lock(hdev);\n    hcon = hci_conn_hash_lookup_handle(hdev, handle);\n    ...\n    conn = sco_conn_hold_unless_zero(hcon->sco_data);\n    hci_dev_unlock(hdev);\n\nbut the pointer is cleared from the other side without that lock. When\nthe last sco_conn reference is dropped, sco_conn_free() ran\n\n    conn->hcon->sco_data = NULL;\n\nwith no hdev->lock held, so the RX path could read hcon->sco_data and\ncall kref_get_unless_zero() on an sco_conn that was concurrently freed:\n\n    BUG: KASAN: slab-use-after-free in sco_conn_hold_unless_zero+0xbe/0x160\n    Write of size 4 by task kworker/u17:0\n    Workqueue: hci0 hci_rx_work\n    Call Trace:\n     sco_conn_hold_unless_zero+0xbe/0x160\n     sco_recv_scodata+0x13f/0x490\n     hci_rx_work+0x3af/0x730\n\nkref_get_unless_zero() only guards against a zero refcount, not against\nthe backing memory already being freed.\n\nGive hcon->sco_data an actual reference on the sco_conn it points to, so\nthe object cannot be freed while the pointer is still installed, and only\nclear and drop it from sco_conn_del(), which runs under hdev->lock (its\ncallers, sco_connect_cfm() and sco_disconn_cfm(), hold it). The reader in\nsco_recv_scodata() also takes hdev->lock, so the store and the read are\nnow serialised: the RX path either observes NULL or a reference that is\nguaranteed to stay valid until it drops its own.\n\nsco_conn_add() no longer hands its kref_init() reference to the caller as\nthe connection's only reference; that initial reference is the one owned\nby hcon->sco_data, and callers get their own via sco_conn_hold().\n\nBecause the sco_conn can now outlive the socket (the association keeps it\nalive until the link goes down), the hci_conn can no longer be dropped\nfrom sco_conn_free() without regressing socket close: closing a connected\nSCO socket must still tear the link down. Move hci_conn ownership to the\nsocket instead: __sco_chan_add() takes an hci_conn reference and it is\nreleased from sco_chan_del() and sco_sock_destruct(), exactly once. The\nsco_conn no longer owns an hci_conn reference, so sco_conn_add() stops\nconsuming one and sco_connect() drops the hci_connect_sco() reference on\nevery path; sco_connect_cfm() no longer needs its hci_conn_hold() dance.","state":0,"publishedAt":"2026-10-23T12:20:36.46+00:00","modifiedAt":"2026-10-24T14:09:59.382+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"e6720779ae612a14ac4ba7fe4fd5b27d900d932c\",\n                            \"lessThan\": \"b108ea7ebba147465f4158d8133f0e8f013762ed\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e6720779ae612a14ac4ba7fe4fd5b27d900d932c\",\n                            \"lessThan\": \"8a98d58f6cfe70d51138cd9ce894e72671d95f8a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"e6720779ae612a14ac4ba7fe4fd5b27d900d932c\",\n                            \"lessThan\": \"816fb1590a4c8cf8d05cd076057616be02e276f0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/bluetooth/sco.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.13\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.13\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.57\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.11\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/b108ea7ebba147465f4158d8133f0e8f013762ed","https://git.kernel.org/stable/c/8a98d58f6cfe70d51138cd9ce894e72671d95f8a","https://git.kernel.org/stable/c/816fb1590a4c8cf8d05cd076057616be02e276f0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-99011","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-99011","identifiers":["CVE-2026-99011"]},"retained":false,"historicalAffected":[]}],"coverage":[]}