{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-43023", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-43023", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-05-01T14:15:25.736Z", "updatedAt": "2026-10-19T19:06:09.917Z", "importedAt": "2026-10-24T01:58:08.712Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "Bluetooth: SCO: fix race conditions in sco_sock_connect()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n Thread A (connect): HCI disconnect: Thread B (connect):\n\n sco_sock_connect(sk) sco_sock_connect(sk)\n sk_state==BT_OPEN sk_state==BT_OPEN\n (pass, no lock) (pass, no lock)\n sco_connect(sk): sco_connect(sk):\n hci_dev_lock hci_dev_lock\n hci_connect_sco <- blocked\n -> hcon1\n sco_conn_add->conn1\n lock_sock(sk)\n sco_chan_add:\n conn1->sk = sk\n sk->conn = conn1\n sk_state=BT_CONNECT\n release_sock\n hci_dev_unlock\n hci_dev_lock\n sco_conn_del:\n lock_sock(sk)\n sco_chan_del:\n sk->conn=NULL\n conn1->sk=NULL\n sk_state=\n BT_CLOSED\n SOCK_ZAPPED\n release_sock\n hci_dev_unlock\n (unblocked)\n hci_connect_sco\n -> hcon2\n sco_conn_add\n -> conn2\n lock_sock(sk)\n sco_chan_add:\n sk->conn=conn2\n sk_state=\n BT_CONNECT\n // zombie sk!\n release_sock\n hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n HCI connection leaks", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "70a13b1e25fef37c87c8a1228ddb8900efbca7cf", "status": "affected", "versionType": "git", "lessThan": "dabf22269242e2f2bf44c43fcdc2fa763df7f9cc" }, { "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "status": "affected", "versionType": "git", "lessThan": "adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0" }, { "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "status": "affected", "versionType": "git", "lessThan": "7e296ffdab5bdab718dff7c14288fdcb9154fa27" }, { "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "status": "affected", "versionType": "git", "lessThan": "98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d" }, { "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "status": "affected", "versionType": "git", "lessThan": "d002bd11024bd231bcb606877e33951ffb7bed14" }, { "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "status": "affected", "versionType": "git", "lessThan": "8a5b0135d4a5d9683203a3d9a12a711ccec5936b" }, { "version": "6.1.109", "status": "affected", "versionType": "semver", "lessThan": "6.1.168" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.3", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.3" }, { "version": "6.1.168", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.134", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.81", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.22", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "6.19.12", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.19.*" }, { "version": "7.0", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }