EUVD-2026-80255
GHSA-g3p6-8r9x-w9g7
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bluetooth range gives AV:A; the concurrent-close race makes AC:H; no auth (PR:N); kernel UAF most reliably yields crash (A:H) with only speculative C/I (kept low).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SCO: hold sk properly in sco_conn_ready
sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state:
[Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref
and similarly for access to sco_get_sock_listen() return value.
Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any.
AnalysisAI
A use-after-free in the Linux kernel's Bluetooth SCO (synchronous connection-oriented) socket handling lets an attacker within Bluetooth radio range race the SCO connection-ready path against a concurrent socket close, dereferencing a freed socket with the potential for kernel memory corruption or a crash. Only systems with Bluetooth enabled and an active SCO listening socket are exposed, and exploitation is unauthenticated but adjacent (AV:A) and highly timing-dependent (AC:H in independent assessment), with the realistic outcome being a kernel denial of service rather than reliable code execution. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target to have Bluetooth enabled with an active SCO (audio) listening socket, and the attacker must be within Bluetooth radio range (AV:A, adjacent). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a Linux kernel Bluetooth SCO (synchronous connection-oriented, i.e. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream stable fix by upgrading to Linux 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40 or 7.1 (or a later release containing commit 27c24fda62b601d6f9ca5e992502578c4310876f's successor patches); distribution kernels should be updated to the vendor build that backports the referenced stable commits, obtainable from the git.kernel.org links listed in the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Vendor-released patch: 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today