Linux kernel CVE-2026-99011

Exploitation requires Bluetooth-adjacent access (AV:A) to a host with the Bluetooth stack active and an SCO/eSCO audio link in use - the vulnerable path is sco_recv_scodata() in hci_rx_work, which only runs for SCO connections. The specific trigger is a concurrency race: the attacker must cause the RX path to read hcon->sco_data at the same moment the last sco_conn reference is dropped in sco_conn_free() (which cleared the pointer without hdev->lock), per the commit. Limiting factors that reduce realistic risk: the adjacency requirement (not internet-reachable), the need for an established SCO session (reflected as UI:R), and the narrow, timing-dependent race window (AC:H) that makes reliable exploitation difficult rather than a deterministic single-shot trigger. Hosts with Bluetooth disabled or no SCO audio usage are not reachable.

This is a genuine kernel use-after-free, but the real-world risk signals point to a moderate rather than urgent threat. The CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.1) is internally consistent with the commit text: AV:A reflects the Bluetooth-adjacent attack surface, and AC:H is justified by actual evidence - the flaw is a race between sco_recv_scodata() upgrading the weak hcon->sco_data back-pointer under hdev->lock and sco_conn_free() clearing that pointer without the lock, so the attacker must win a narrow timing window rather than exploit a deterministic condition. EPSS is low (0.21%, 10th percentile), the CVE is NOT in CISA KEV, and no public exploit or PoC reference is present (the only links are the stable-tree fix commits), so there is no evidence of exploitation or weaponization. These signals agree: a locally/adjacently reachable, race-dependent kernel bug that is hard to drive remotely. The vuln.today decision label is 'this_week', consistent with 'patch on a normal cadence' rather than emergency. Note a tension worth verifying: the input Tags label this 'Information Disclosure', yet the commit and KASAN trace describe a slab use-after-free write, which is memory corruption (DoS/possible privilege escalation) rather than a pure read primitive - treat the disclosure framing with caution.

An attacker within Bluetooth range establishes or induces an SCO (audio) link to a target Linux host and then forces connection teardown while SCO data frames are still arriving, racing the RX worker against the freeing of the sco_conn object. If the race is won, hci_rx_work touches hcon->sco_data after the backing sco_conn has been freed, producing a kernel use-after-free that most reliably crashes the host (DoS) and could theoretically be developed toward memory corruption. No public exploit or PoC code has been identified; AC:H and the adjacent vector make reliable exploitation difficult.