CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-06 · updated 2026-10-19
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

Affected products

Linux kernel: from 2.6.12.1 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21; from 6.19 before 6.19.11 — fixed in 5.15.203, 6.1.168, 6.12.80, 6.18.21, 6.19.11, 6.6.131

How to fix

Upgrade to a fixed version: Linux kernel 5.15.203, 6.1.168, 6.12.80, 6.18.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31408 or the next vulnerability affects your stack