{"id":"CVE-2026-99011","kind":"vulnerability","aliases":["CVE-2026-99011"],"related":[],"title":"Linux kernel: Bluetooth SCO use-after-free in receive path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()\n\nsco_recv_scodata() upgrades the weak hcon->sco_data back-pointer to a\nstrong reference under hdev->lock:\n\n    hci_dev_lock(hdev);\n    hcon = hci_conn_hash_lookup_handle(hdev, handle);\n    ...\n    conn = sco_conn_hold_unless_zero(hcon->sco_data);\n    hci_dev_unlock(hdev);\n\nbut the pointer is cleared from the other side without that lock. When\nthe last sco_conn reference is dropped, sco_conn_free() ran\n\n    conn->hcon->sco_data = NULL;\n\nwith no hdev->lock held, so the RX path could read hcon->sco_data and\ncall kref_get_unless_zero() on an sco_conn that was concurrently freed:\n\n    BUG: KASAN: slab-use-after-free in sco_conn_hold_unless_zero+0xbe/0x160\n    Write of size 4 by task kworker/u17:0\n    Workqueue: hci0 hci_rx_work\n    Call Trace:\n     sco_conn_hold_unless_zero+0xbe/0x160\n     sco_recv_scodata+0x13f/0x490\n     hci_rx_work+0x3af/0x730\n\nkref_get_unless_zero() only guards against a zero refcount, not against\nthe backing memory already being freed.\n\nGive hcon->sco_data an actual reference on the sco_conn it points to, so\nthe object cannot be freed while the pointer is still installed, and only\nclear and drop it from sco_conn_del(), which runs under hdev->lock (its\ncallers, sco_connect_cfm() and sco_disconn_cfm(), hold it). The reader in\nsco_recv_scodata() also takes hdev->lock, so the store and the read are\nnow serialised: the RX path either observes NULL or a reference that is\nguaranteed to stay valid until it drops its own.\n\nsco_conn_add() no longer hands its kref_init() reference to the caller as\nthe connection's only reference; that initial reference is the one owned\nby hcon->sco_data, and callers get their own via sco_conn_hold().\n\nBecause the sco_conn can now outlive the socket (the association keeps it\nalive until the link goes down), the hci_conn can no longer be dropped\nfrom sco_conn_free() without regressing socket close: closing a connected\nSCO socket must still tear the link down. Move hci_conn ownership to the\nsocket instead: __sco_chan_add() takes an hci_conn reference and it is\nreleased from sco_chan_del() and sco_sock_destruct(), exactly once. The\nsco_conn no longer owns an hci_conn reference, so sco_conn_add() stops\nconsuming one and sco_connect() drops the hci_connect_sco() reference on\nevery path; sco_connect_cfm() no longer needs its hci_conn_hold() dance.","summary":"A race in the Linux kernel Bluetooth SCO code lets the receive path use a connection object after it has been freed. The sources describe a KASAN-reported use-after-free; they do not state what an attacker can achieve with it.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bluetooth","linux-kernel","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:55:47+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:55:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: Bluetooth SCO use-after-free in receive path","impact":"medium","summary":"A race in the Linux kernel Bluetooth SCO code lets the receive path use a connection object after it has been freed. The sources describe a KASAN-reported use-after-free; they do not state what an attacker can achieve with it.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","bluetooth"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; a use-after-free in kernel memory, impact not stated","analyst_note":"Find the kernel stable commit fixing sco_conn lifetime and the affected and fixed kernel versions, and check whether a remote trigger exists (SCO RX runs on HCI events from a paired or connected device).","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000611,"input_tokens":4219,"output_tokens":379,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':199C,221C,226C,231C '-2026':13A,16A '-99011':14A,17A '0':208C '4':204C 'achiev':64B 'actual':256C 'add':344C,437C,470C 'aliv':394C 'alreadi':248C 'also':309C 'associ':391C 'attack':62B 'back':95C,246C 'back-point':94C 'bluetooth':3A,18B,29B,75C 'bug':186C 'call':173C,214C 'caller':293C,354C,373C 'cannot':268C 'cfm':296C,300C,488C 'chan':436C,449C 'clear':133C,279C 'close':415C,416C 'code':31B 'concurr':184C 'conn':79C,110C,116C,118C,145C,150C,153C,181C,195C,217C,261C,285C,343C,379C,384C,402C,410C,429C,441C,459C,465C,469C,494C 'connect':38B,295C,357C,418C,476C,480C,487C 'consum':472C 'could':167C 'cve':12A,15A 'danc':496C 'data':93C,124C,156C,171C,254C,371C 'del':286C,450C 'describ':47B 'destruct':454C 'dev':105C,126C 'disconn':299C 'drop':148C,281C,339C,407C,477C 'either':325C 'everi':484C 'exact':455C 'follow':70C 'free':8A,55B,151C,192C,411C 'freed':44B,185C,250C,270C 'get':175C,234C,374C 'give':251C 'goe':398C 'guarante':333C 'guard':238C 'hand':347C 'handl':113C,115C 'hash':111C 'hci':104C,109C,125C,211C,228C,401C,428C,440C,464C,479C,493C 'hci0':210C 'hcon':91C,108C,122C,154C,169C,252C,369C 'hdev':102C,107C,114C,128C,160C,290C,311C 'held':162C 'hold':119C,196C,218C,301C,380C,495C 'init':350C 'initi':362C 'instal':276C 'instead':434C 'kasan':50B,187C 'kasan-report':49B 'keep':392C 'kernel':2A,21B,28B,68C 'kref':174C,233C,349C 'kworker/u17':207C 'last':143C 'let':32B 'lifetim':80C 'link':397C,425C 'linux':1A,20B,27B,67C 'linux-kernel':19B 'lock':103C,106C,140C,161C,291C,312C 'longer':346C,405C,461C,490C 'lookup':112C 'memori':247C 'move':427C 'must':421C 'need':491C 'null':157C,327C 'object':39B,267C 'observ':326C 'one':366C,473C 'outliv':387C 'own':367C,462C 'ownership':430C 'path':11A,35B,166C,324C,485C 'point':263C 'pointer':96C,131C,273C 'race':24B 'ran':152C 'read':168C,318C 'reader':304C 'receiv':10A,34B 'recv':83C,86C,224C,307C 'refcount':242C 'refer':100C,146C,257C,330C,351C,360C,363C,442C,466C,482C 'regress':413C 'releas':446C 'report':51B 'resolv':74C 'run':288C 'runtim':22B 'rx':165C,212C,229C,323C 'sco':4A,30B,76C,78C,82C,85C,92C,117C,123C,144C,149C,155C,170C,180C,194C,216C,223C,253C,260C,284C,294C,298C,306C,342C,370C,378C,383C,409C,419C,435C,448C,452C,458C,468C,475C,481C,486C 'scodata':84C,87C,225C,308C 'serialis':77C,321C 'side':137C 'size':203C 'slab':189C 'slab-use-after-fre':188C 'sock':453C 'socket':389C,414C,420C,433C 'sourc':46B 'state':59B 'stay':335C 'still':275C,422C 'stop':471C 'store':315C 'strong':99C 'take':310C,438C 'task':206C 'tear':423C 'trace':215C 'unless':120C,176C,197C,219C,235C 'unlock':127C 'upgrad':88C 'use':6A,36B,53B,190C 'use-after-fre':5A,52B 'valid':336C 'via':377C 'vulner':71C 'weak':90C 'without':138C,412C 'work':213C,230C 'workqueu':209C 'write':201C 'x13f/0x490':227C 'x3af/0x730':232C 'xbe/0x160':200C,222C 'zero':121C,177C,198C,220C,236C,241C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:23+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99011","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99011","severity":null,"published_at":"2026-10-23T13:17:23+00:00","modified_at":"2026-10-23T13:17:23+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99011","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99011","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}