Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own sco_conn reference sco_conn_del() drops a reference it does not own. It takes one transient reference via sco_conn_hold_unless_zero() and releases it with the sco_conn_put() that follows sco_sock_hold(); the additional put in the !sk branch releases a second one: conn = sco_conn_hold_unless_zero(conn); ... sk = sco_sock_hold(conn); sco_conn_unlock(conn); sco_conn_put(conn); if (!sk) { sco_conn_put(conn); return; } When close() races the controller's Disconnection Complete, sco_chan_del() clears conn->sk and drops the socket's reference while sco_conn_del() is running. sco_conn_del() then sees sk == NULL, its own put drops the count to zero and frees the conn, and the second put writes to the freed kref: BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190 Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413 Workqueue: hci1 hci_rx_work Call Trace: sco_conn_put.part.0+0x1a/0x190 hci_disconn_complete_evt+0x1ee/0x3e0 hci_event_packet+0x54a/0x650 hci_rx_work+0x321/0x3d0 Allocated by task 413: sco_conn_add+0x72/0x1a0 sco_connect_cfm+0x88/0x670 Freed by task 413: sco_conn_del.isra.0+0x3f/0xf0 hci_disconn_complete_evt+0x1ee/0x3e0 refcount_t: underflow; use-after-free. The root cause is that the socket stores the connection without holding a reference of its own. __sco_chan_add() does: sco_pi(sk)->conn = conn; so the socket borrows whatever reference its caller happened to hold, and the callers paper over that with ad-hoc holds and puts. Give the socket a counted reference instead: __sco_chan_add() takes one and it is released together with the channel (sco_chan_del()) and in sco_sock_destruct(). With the socket holding its own reference, sco_conn_del() no longer needs the extra put and the redundant hold in sco_conn_ready() goes away. Making the socket own its reference means the connection is now actually freed on the error paths of sco_connect() where it used to leak, which in turn runs sco_conn_free() and its hci_conn_drop(conn->hcon). To keep the hci_conn accounting balanced, make that ownership explicit as well: sco_conn_add() consumes one hci_conn reference and the sco_conn owns it for its lifetime. sco_connect() hands over the reference returned by hci_connect_sco() and no longer drops it on the error paths; sco_connect_cfm(), which is not given a reference, takes one with hci_conn_hold() before handing it to sco_conn_add() (and drops it again if the allocation fails); and the explicit hci_conn_hold() in sco_conn_ready() is removed. Every reference then has a single, clear owner.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-28T08:16:53.737Z",
  "pubdate": "2026-08-28T08:16:53.737Z",
  "executiveSummary": "A critical use-after-free vulnerability exists in the Linux kernel's Bluetooth Synchronous Connection-Oriented (SCO) implementation, specifically within the connection management logic.\nThe vulnerability stems from improper reference counting for sco_conn objects, where a race condition between socket closure and controller disconnection events triggers a double-put operation on a freed object.\nThe flaw affects the Linux kernel's Bluetooth subsystem, potentially allowing an attacker to trigger kernel memory corruption or a system crash (Denial of Service).\nExploitation requires a race condition during Bluetooth connection teardown, which may be achievable by a local user or an attacker capable of manipulating Bluetooth signaling to force specific connection state transitions.\nThe primary risk is a Use-After-Free (UAF) condition, which can lead to unpredictable kernel behavior, memory corruption, or local privilege escalation, depending on the kernel's state during the invalid access.",
  "technicalDetails": "The vulnerability is rooted in an inconsistent ownership model for the sco_conn structure within the Linux kernel Bluetooth subsystem. Previously, the socket structure stored a pointer to the connection object without incrementing the reference count, effectively 'borrowing' a reference from the caller. This necessitated ad-hoc reference counting maneuvers, which were susceptible to race conditions.\nSpecifically, sco_conn_del() attempted to release a reference that it did not formally own. It performed a transient hold using sco_conn_hold_unless_zero(), followed by a put operation. If the socket structure (sk) was nullified (e.g., via sco_chan_del() during an asynchronous Disconnection Complete event) before the second put could be executed, the system would attempt to drop a reference on an already freed object.\nThe attack flow is triggered by a race condition: 1. A socket initiates closure, triggering sco_chan_del(), which clears conn->sk and decrements the socket's reference count. 2. Concurrently, an hci_disconn_complete_evt occurs, calling sco_conn_del(). 3. Because the socket reference is already cleared, sco_conn_del() fails to verify ownership properly, leading to a secondary put on the memory, resulting in a slab-use-after-free error.\nThe vulnerability manifests because the object lifecycle management did not account for the socket holding its own reference. Consequently, the sco_conn structure was freed prematurely if the reference count hit zero during the race. The technical consequence is a kernel panic or heap corruption as the kernel attempts to write to memory addresses previously managed by the slab allocator.\nThe resolution involves enforcing a strict ownership model where the socket holds a counted reference to its connection for the entire duration of the channel's lifecycle. This replaces the precarious 'borrowing' mechanism. Furthermore, the fix synchronizes hci_conn accounting, ensuring that the sco_conn object explicitly owns a single hci_conn reference throughout its lifetime. This eliminates redundant holds and puts in functions like sco_conn_ready() and closes memory leak vectors in error-handling paths within sco_connect()."
}