{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: SCO: fix race conditions in sco_sock_connect()\\n\\nsco_sock_connect() checks sk_state and sk_type without holding\\nthe socket lock. Two concurrent connect() syscalls on the same\\nsocket can both pass the check and enter sco_connect(), leading\\nto use-after-free.\\n\\nThe buggy scenario involves three participants and was confirmed\\nwith additional logging instrumentation:\\n\\n Thread A (connect): HCI disconnect: Thread B (connect):\\n\\n sco_sock_connect(sk) sco_sock_connect(sk)\\n sk_state==BT_OPEN sk_state==BT_OPEN\\n (pass, no lock) (pass, no lock)\\n sco_connect(sk): sco_connect(sk):\\n hci_dev_lock hci_dev_lock\\n hci_connect_sco \\u003c- blocked\\n -\\u003e hcon1\\n sco_conn_add-\\u003econn1\\n lock_sock(sk)\\n sco_chan_add:\\n conn1-\\u003esk = sk\\n sk-\\u003econn = conn1\\n sk_state=BT_CONNECT\\n release_sock\\n hci_dev_unlock\\n hci_dev_lock\\n sco_conn_del:\\n lock_sock(sk)\\n sco_chan_del:\\n sk-\\u003econn=NULL\\n conn1-\\u003esk=NULL\\n sk_state=\\n BT_CLOSED\\n SOCK_ZAPPED\\n release_sock\\n hci_dev_unlock\\n (unblocked)\\n hci_connect_sco\\n -\\u003e hcon2\\n sco_conn_add\\n -\\u003e conn2\\n lock_sock(sk)\\n sco_chan_add:\\n sk-\\u003econn=conn2\\n sk_state=\\n BT_CONNECT\\n \/\/ zombie sk!\\n release_sock\\n hci_dev_unlock\\n\\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\\nwhen sco_conn_del() cleared the association.\\n\\nFix this by:\\n- Moving lock_sock() before the sk_state\/sk_type checks in\\n sco_sock_connect() to serialize concurrent connect attempts\\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\\n return the error instead of just assigning it\\n- Adding a state re-check in sco_connect() after lock_sock()\\n to catch state changes during the window between the locks\\n- Adding sco_pi(sk)-\\u003econn check in sco_chan_add() to prevent\\n double-attach of a socket to multiple connections\\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\\n HCI connection leaks”,”published”:”2026-05-01T14:15:25.736Z”,”modified”:”2026-05-03T05:46:08.089Z”,”type”:”cve”,”title”:”Bluetooth: SCO: fix race conditions in sco_sock_connect()”,”source”:”Linux”,”references”:”https:\/\/git.kernel.org\/stable\/c\/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc\\nhttps:\/\/git.kernel.org\/stable\/c\/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0\\nhttps:\/\/git.kernel.org\/stable\/c\/7e296ffdab5bdab718dff7c14288fdcb9154fa27\\nhttps:\/\/git.kernel.org\/stable\/c\/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d\\nhttps:\/\/git.kernel.org\/stable\/c\/d002bd11024bd231bcb606877e33951ffb7bed14\\nhttps:\/\/git.kernel.org\/stable\/c\/8a5b0135d4a5d9683203a3d9a12a711ccec5936b”,”id”:”CVE-2026-43023″,”bulletinFamily”:””,”cwe”:null,”cvelist”:null,”sourceData”:”Linux Linux 70a13b1e25fef37c87c8a1228ddb8900efbca7cf\\nLinux Linux 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\\nLinux Linux 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\\nLinux Linux 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\\nLinux Linux 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\\nLinux Linux 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\\nLinux Linux 6.3″,”sourceHref”:””,”cvss”:{“score”:7.8,”severity”:”HIGH”,”vector”:”CVSS:3.1\/AV:L\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”Linux”,”version”:”70a13b1e25fef37c87c8a1228ddb8900efbca7cf”,”vendor”:”Linux”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: SCO: fix race conditions in sco_sock_connect()\\n\\nsco_sock_connect() checks sk_state and sk_type without holding\\nthe socket lock. Two…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,28,12,15,13,7,11,5],"class_list":["post-51003","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-78","tag-exploit","tag-high","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n