{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80683", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.784Z", "datePublished": "2026-08-28T06:52:50.099Z", "dateUpdated": "2026-08-29T06:22:10.283Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-29T06:22:10.283Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: give the socket its own sco_conn reference\n\nsco_conn_del() drops a reference it does not own. It takes one transient\nreference via sco_conn_hold_unless_zero() and releases it with the\nsco_conn_put() that follows sco_sock_hold(); the additional put in the\n!sk branch releases a second one:\n\n conn = sco_conn_hold_unless_zero(conn);\n ...\n sk = sco_sock_hold(conn);\n sco_conn_unlock(conn);\n sco_conn_put(conn);\n\n if (!sk) {\n sco_conn_put(conn);\n return;\n }\n\nWhen close() races the controller's Disconnection Complete, sco_chan_del()\nclears conn->sk and drops the socket's reference while sco_conn_del() is\nrunning. sco_conn_del() then sees sk == NULL, its own put drops the count\nto zero and frees the conn, and the second put writes to the freed kref:\n\n BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190\n Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413\n Workqueue: hci1 hci_rx_work\n Call Trace:\n sco_conn_put.part.0+0x1a/0x190\n hci_disconn_complete_evt+0x1ee/0x3e0\n hci_event_packet+0x54a/0x650\n hci_rx_work+0x321/0x3d0\n Allocated by task 413:\n sco_conn_add+0x72/0x1a0\n sco_connect_cfm+0x88/0x670\n Freed by task 413:\n sco_conn_del.isra.0+0x3f/0xf0\n hci_disconn_complete_evt+0x1ee/0x3e0\n refcount_t: underflow; use-after-free.\n\nThe root cause is that the socket stores the connection without holding a\nreference of its own. __sco_chan_add() does:\n\n sco_pi(sk)->conn = conn;\n\nso the socket borrows whatever reference its caller happened to hold, and\nthe callers paper over that with ad-hoc holds and puts. Give the socket a\ncounted reference instead: __sco_chan_add() takes one and it is released\ntogether with the channel (sco_chan_del()) and in sco_sock_destruct().\nWith the socket holding its own reference, sco_conn_del() no longer needs\nthe extra put and the redundant hold in sco_conn_ready() goes away.\n\nMaking the socket own its reference means the connection is now actually\nfreed on the error paths of sco_connect() where it used to leak, which in\nturn runs sco_conn_free() and its hci_conn_drop(conn->hcon). To keep the\nhci_conn accounting balanced, make that ownership explicit as well:\nsco_conn_add() consumes one hci_conn reference and the sco_conn owns it for\nits lifetime. sco_connect() hands over the reference returned by\nhci_connect_sco() and no longer drops it on the error paths;\nsco_connect_cfm(), which is not given a reference, takes one with\nhci_conn_hold() before handing it to sco_conn_add() (and drops it again if\nthe allocation fails); and the explicit hci_conn_hold() in sco_conn_ready()\nis removed. Every reference then has a single, clear owner."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The UAF is triggered in sco_conn_del() from hci_disconn_complete_evt on hci_rx_work when the Bluetooth controller reports SCO/eSCO teardown, which is driven by an in-range peer disconnect; Bluetooth SCO is an adjacent-radio protocol path, not a local-only syscall entry point.\nAC:L - The failure is a close()-versus-Disconnection-Complete race where the attacker controls both sides by concurrently closing the SCO socket while inducing HCI disconnect (local threads or a nearby peer hanging up), and can repeat connect/disconnect cycles until the window is hit.\nPR:N - An adjacent Bluetooth peer can send the disconnect that produces Disconnection Complete without any Linux credentials on the victim, and SCO sockets have no capability gate; only an active SCO session on init_net is needed, not root or CAP_NET_ADMIN.\nUI:N - Exploitation does not require victim interaction beyond an already-active SCO link (headset/call); the attacker can time peer-initiated disconnects against automatic socket teardown without social engineering or manual victim steps.\nS:U - The refcount use-after-free corrupts kernel Bluetooth connection state within the same kernel security authority; it is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - sco_conn_del() performs a double sco_conn_put() that writes to a freed kref (4-byte slab UAF), enabling heap reuse and arbitrary kernel memory disclosure primitives consistent with kernel use-after-free confidentiality impact.\nI:H - The post-free kref decrement is a controlled kernel heap write that can be groomed via repeated SCO connect/close and disconnect cycles to corrupt adjacent slab objects and achieve arbitrary write or control-flow hijack.\nA:H - The bug reliably triggers kernel KASAN slab-use-after-free and refcount underflow on hci_rx_work during disconnect handling, producing oops/panic, and can be retriggered to deny service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/sco.c"], "versions": [{"version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c", "lessThan": "a33bc07b4730b6cd5681ac77d18ae0de3e739690", "status": "affected", "versionType": "git"}, {"version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c", "lessThan": "8fe627192fa5da7157f9a48608f13c04b6373e43", "status": "affected", "versionType": "git"}, {"version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c", "lessThan": "abd93c85c8667add738ee82aeab95dd9fc8265a2", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/sco.c"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a33bc07b4730b6cd5681ac77d18ae0de3e739690"}, {"url": "https://git.kernel.org/stable/c/8fe627192fa5da7157f9a48608f13c04b6373e43"}, {"url": "https://git.kernel.org/stable/c/abd93c85c8667add738ee82aeab95dd9fc8265a2"}], "title": "Bluetooth: SCO: give the socket its own sco_conn reference", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a33bc07b4730b6cd5681ac77d18ae0de3e739690", "status": "affected", "version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c", "versionType": "git"}, {"lessThan": "8fe627192fa5da7157f9a48608f13c04b6373e43", "status": "affected", "version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c", "versionType": "git"}, {"lessThan": "abd93c85c8667add738ee82aeab95dd9fc8265a2", "status": "affected", "version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: give the socket its own sco_conn reference\n\nsco_conn_del() drops a reference it does not own. It takes one transient\nreference via sco_conn_hold_unless_zero() and releases it with the\nsco_conn_put() that follows sco_sock_hold(); the additional put in the\n!sk branch releases a second one:\n\n conn = sco_conn_hold_unless_zero(conn);\n ...\n sk = sco_sock_hold(conn);\n sco_conn_unlock(conn);\n sco_conn_put(conn);\n\n if (!sk) {\n sco_conn_put(conn);\n return;\n }\n\nWhen close() races the controller's Disconnection Complete, sco_chan_del()\nclears conn->sk and drops the socket's reference while sco_conn_del() is\nrunning. sco_conn_del() then sees sk == NULL, its own put drops the count\nto zero and frees the conn, and the second put writes to the freed kref:\n\n BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190\n Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413\n Workqueue: hci1 hci_rx_work\n Call Trace:\n sco_conn_put.part.0+0x1a/0x190\n hci_disconn_complete_evt+0x1ee/0x3e0\n hci_event_packet+0x54a/0x650\n hci_rx_work+0x321/0x3d0\n Allocated by task 413:\n sco_conn_add+0x72/0x1a0\n sco_connect_cfm+0x88/0x670\n Freed by task 413:\n sco_conn_del.isra.0+0x3f/0xf0\n hci_disconn_complete_evt+0x1ee/0x3e0\n refcount_t: underflow; use-after-free.\n\nThe root cause is that the socket stores the connection without holding a\nreference of its own. __sco_chan_add() does:\n\n sco_pi(sk)->conn = conn;\n\nso the socket borrows whatever reference its caller happened to hold, and\nthe callers paper over that with ad-hoc holds and puts. Give the socket a\ncounted reference instead: __sco_chan_add() takes one and it is released\ntogether with the channel (sco_chan_del()) and in sco_sock_destruct().\nWith the socket holding its own reference, sco_conn_del() no longer needs\nthe extra put and the redundant hold in sco_conn_ready() goes away.\n\nMaking the socket own its reference means the connection is now actually\nfreed on the error paths of sco_connect() where it used to leak, which in\nturn runs sco_conn_free() and its hci_conn_drop(conn->hcon). To keep the\nhci_conn accounting balanced, make that ownership explicit as well:\nsco_conn_add() consumes one hci_conn reference and the sco_conn owns it for\nits lifetime. sco_connect() hands over the reference returned by\nhci_connect_sco() and no longer drops it on the error paths;\nsco_connect_cfm(), which is not given a reference, takes one with\nhci_conn_hold() before handing it to sco_conn_add() (and drops it again if\nthe allocation fails); and the explicit hci_conn_hold() in sco_conn_ready()\nis removed. Every reference then has a single, clear owner."}], "id": "CVE-2026-80683", "lastModified": "2026-08-29T07:16:50.850", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-28T08:16:53.737", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8fe627192fa5da7157f9a48608f13c04b6373e43"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a33bc07b4730b6cd5681ac77d18ae0de3e739690"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abd93c85c8667add738ee82aeab95dd9fc8265a2"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e6720779ae612a14ac4ba7fe4fd5b27d900d932c,a33bc07b4730b6cd5681ac77d18ae0de3e739690)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e6720779ae612a14ac4ba7fe4fd5b27d900d932c,8fe627192fa5da7157f9a48608f13c04b6373e43)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e6720779ae612a14ac4ba7fe4fd5b27d900d932c,abd93c85c8667add738ee82aeab95dd9fc8265a2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.44,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-28T10:45:04.387203+00:00", "updated": "2026-08-28T13:45:17.074599+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-762"]}