HIGH Introduced in 5.15
bluetooth ConnReady UAF
CVE-2026-89774
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any.
02KernelScan AI Analysis
Risk summary
A use-after-free vulnerability exists in the Linux kernel's Bluetooth SCO connection handling, where a socket can be freed by a concurrent close operation while still being accessed. An attacker with Bluetooth proximity or local Bluetooth socket access can trigger a race condition leading to kernel memory corruption, potentially resulting in privilege escalation or system crash. Any system with Bluetooth enabled is at risk.
Vulnerability analysis
When a Bluetooth SCO connection becomes ready, the handler reads and dereferences a socket pointer without holding a reference count on that socket. If another thread closes the socket concurrently, the socket can be freed while the connection handler is still using it, resulting in a use-after-free. The same issue affects the lookup of a listening parent socket. The fix takes a reference count on the socket before accessing it and rechecks that the socket is still valid after acquiring the socket lock, ensuring the socket cannot be freed during use. The teardown path is also adjusted so that clearing the connection's socket pointer is synchronized via the socket lock. This race is reachable by any local user with access to Bluetooth sockets, and the connection-ready path can also be triggered by a nearby Bluetooth device initiating a connection to a listening socket, requiring no privileges on the target system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15 | 5.15.212 | 50aae396dc30 |
| 6.1 | 5.15 | 6.1.178 | 6e3840578aaa |
| 6.12 | 5.15 | 6.12.97 | 73cb063f5ec6 |
| mainline | 5.15 | 7.1 | 4e37f6452d58 |
| 6.6 | 5.15 | 6.6.145 | d141d9b769bc |
| 6.18 | 5.15 | 6.18.40 | 7199c78c3a3e |
| cip/6.1 | 5.15 | 6.1.182-cip59 | 6e3840578aaa |
| cip/6.1-rt | 5.15 | 6.1.182-cip59-rt31 | 6e3840578aaa |
| cip/6.12 | 5.15 | 6.12.101-cip29 | 73cb063f5ec6 |