CVE-2026-89774

Bluetooth: SCO: hold sk properly in sco_conn_ready

CVSS 3.1 8.8 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-89774

Published

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-89774

Published

Linux

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/bluetooth/sco.c"
                    ],
                    "versions": [
                        {
                            "version": "27c24fda62b601d6f9ca5e992502578c4310876f",
                            "lessThan": "50aae396dc30377bec8e3b181b8346f8fd38f7d8",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "27c24fda62b601d6f9ca5e992502578c4310876f",
                            "lessThan": "6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "27c24fda62b601d6f9ca5e992502578c4310876f",
                            "lessThan": "d141d9b769bcd1b747898528c5023270cda040f2",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "27c24fda62b601d6f9ca5e992502578c4310876f",
                            "lessThan": "73cb063f5ec6ca51eb1e246c6d332563002ac277",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "27c24fda62b601d6f9ca5e992502578c4310876f",
                            "lessThan": "7199c78c3a3e399a4dc439d845826793880ccedc",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "27c24fda62b601d6f9ca5e992502578c4310876f",
                            "lessThan": "4e37f6452d586b95c346a9abdd2fb80b67794f39",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                }

Linux

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "net/bluetooth/sco.c"
                    ],
                    "versions": [
                        {
                            "version": "5.15",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.15",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "5.15.212",
                            "lessThanOrEqual": "5.15.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1.178",
                            "lessThanOrEqual": "6.1.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.6.145",
                            "lessThanOrEqual": "6.6.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.12.97",
                            "lessThanOrEqual": "6.12.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.18.40",
                            "lessThanOrEqual": "6.18.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "7.1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON