CVE-2026-43023 (GCVE-0-2026-43023)
Vulnerability from cvelistv5 – Published: 2026-05-01 14:15 – Updated: 2026-08-05 12:25
VLAI
EPSS
VEX
Title
Bluetooth: SCO: fix race conditions in sco_sock_connect()
Summary
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SCO: fix race conditions in sco_sock_connect()
sco_sock_connect() checks sk_state and sk_type without holding
the socket lock. Two concurrent connect() syscalls on the same
socket can both pass the check and enter sco_connect(), leading
to use-after-free.
The buggy scenario involves three participants and was confirmed
with additional logging instrumentation:
Thread A (connect): HCI disconnect: Thread B (connect):
sco_sock_connect(sk) sco_sock_connect(sk)
sk_state==BT_OPEN sk_state==BT_OPEN
(pass, no lock) (pass, no lock)
sco_connect(sk): sco_connect(sk):
hci_dev_lock hci_dev_lock
hci_connect_sco <- blocked
-> hcon1
sco_conn_add->conn1
lock_sock(sk)
sco_chan_add:
conn1->sk = sk
sk->conn = conn1
sk_state=BT_CONNECT
release_sock
hci_dev_unlock
hci_dev_lock
sco_conn_del:
lock_sock(sk)
sco_chan_del:
sk->conn=NULL
conn1->sk=NULL
sk_state=
BT_CLOSED
SOCK_ZAPPED
release_sock
hci_dev_unlock
(unblocked)
hci_connect_sco
-> hcon2
sco_conn_add
-> conn2
lock_sock(sk)
sco_chan_add:
sk->conn=conn2
sk_state=
BT_CONNECT
// zombie sk!
release_sock
hci_dev_unlock
Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to
BT_CONNECT. Subsequent cleanup triggers double sock_put() and
use-after-free. Meanwhile conn1 is leaked as it was orphaned
when sco_conn_del() cleared the association.
Fix this by:
- Moving lock_sock() before the sk_state/sk_type checks in
sco_sock_connect() to serialize concurrent connect attempts
- Fixing the sk_type != SOCK_SEQPACKET check to actually
return the error instead of just assigning it
- Adding a state re-check in sco_connect() after lock_sock()
to catch state changes during the window between the locks
- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent
double-attach of a socket to multiple connections
- Adding hci_conn_drop() on sco_chan_add failure to prevent
HCI connection leaks
Severity
7.8 (High)
Assigner
References
6 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
70a13b1e25fef37c87c8a1228ddb8900efbca7cf , < dabf22269242e2f2bf44c43fcdc2fa763df7f9cc
(git)
Affected: 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 , < adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0 (git) Affected: 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 , < 7e296ffdab5bdab718dff7c14288fdcb9154fa27 (git) Affected: 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 , < 98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d (git) Affected: 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 , < d002bd11024bd231bcb606877e33951ffb7bed14 (git) Affected: 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 , < 8a5b0135d4a5d9683203a3d9a12a711ccec5936b (git) Affected: 6.1.109 , < 6.1.168 (semver) |
guessed | |
| Linux | Linux |
Affected:
6.3
Unaffected: 0 , < 6.3 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.134 , ≤ 6.6.* (semver) Unaffected: 6.12.81 , ≤ 6.12.* (semver) Unaffected: 6.18.22 , ≤ 6.18.* (semver) Unaffected: 6.19.12 , ≤ 6.19.* (semver) Unaffected: 7.0 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "dabf22269242e2f2bf44c43fcdc2fa763df7f9cc",
"status": "affected",
"version": "70a13b1e25fef37c87c8a1228ddb8900efbca7cf",
"versionType": "git"
},
{
"lessThan": "adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0",
"status": "affected",
"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3",
"versionType": "git"
},
{
"lessThan": "7e296ffdab5bdab718dff7c14288fdcb9154fa27",
"status": "affected",
"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3",
"versionType": "git"
},
{
"lessThan": "98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d",
"status": "affected",
"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3",
"versionType": "git"
},
{
"lessThan": "d002bd11024bd231bcb606877e33951ffb7bed14",
"status": "affected",
"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3",
"versionType": "git"
},
{
"lessThan": "8a5b0135d4a5d9683203a3d9a12a711ccec5936b",
"status": "affected",
"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3",
"versionType": "git"
},
{
"lessThan": "6.1.168",
"status": "affected",
"version": "6.1.109",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/bluetooth/sco.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.168",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.134",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.81",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.168",
"versionStartIncluding": "6.1.109",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.134",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.81",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.22",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.12",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n Thread A (connect): HCI disconnect: Thread B (connect):\n\n sco_sock_connect(sk) sco_sock_connect(sk)\n sk_state==BT_OPEN sk_state==BT_OPEN\n (pass, no lock) (pass, no lock)\n sco_connect(sk): sco_connect(sk):\n hci_dev_lock hci_dev_lock\n hci_connect_sco \u003c- blocked\n -\u003e hcon1\n sco_conn_add-\u003econn1\n lock_sock(sk)\n sco_chan_add:\n conn1-\u003esk = sk\n sk-\u003econn = conn1\n sk_state=BT_CONNECT\n release_sock\n hci_dev_unlock\n hci_dev_lock\n sco_conn_del:\n lock_sock(sk)\n sco_chan_del:\n sk-\u003econn=NULL\n conn1-\u003esk=NULL\n sk_state=\n BT_CLOSED\n SOCK_ZAPPED\n release_sock\n hci_dev_unlock\n (unblocked)\n hci_connect_sco\n -\u003e hcon2\n sco_conn_add\n -\u003e conn2\n lock_sock(sk)\n sco_chan_add:\n sk-\u003econn=conn2\n sk_state=\n BT_CONNECT\n // zombie sk!\n release_sock\n hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n to catch state changes during the window between the locks\n- Adding sco_pi(sk)-\u003econn check in sco_chan_add() to prevent\n double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n HCI connection leaks"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerable code is reached through the local connect() syscall on an AF_BLUETOOTH/SCO socket. A Bluetooth peer or HCI disconnect can influence timing, but an adjacent attacker alone cannot race two connect() calls on the same local socket.\nAC:L - The attacker can create the race by issuing concurrent connect() syscalls on the same socket and repeating attempts while the normal HCI failure/disconnect path runs. Under the higher-severity rule, this attacker-controlled race is Low complexity.\nPR:L - SCO socket creation and connect do not impose a capability check, though AF_BLUETOOTH is limited to init_net rather than unprivileged network namespaces. A basic unprivileged local user on the host can open and race BTPROTO_SCO sockets.\nUI:N - No victim action is required once the attacker can run local code. The attacker directly invokes socket/connect operations and can repeat the race.\nS:U - The bug corrupts kernel Bluetooth socket/connection state within the same kernel security authority. It is a standard local kernel compromise/DoS path, not a VM escape or cross-scope boundary bypass.\nC:H - The race leads to a use-after-free/double sock_put on kernel socket objects. Kernel UAFs are defensibly scored as high confidentiality impact because freed objects can be reused for information disclosure primitives.\nI:H - The same UAF/double-free condition can be leveraged through heap reuse and spraying to corrupt kernel objects or control flow. Under the required guidance, UAF memory corruption is High integrity impact.\nA:H - Even without full exploitation, the double sock_put/use-after-free can crash or destabilize the kernel. Kernel crashes and UAF-triggered oops/panic conditions are High availability impact."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:25:19.630Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc"
},
{
"url": "https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0"
},
{
"url": "https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27"
},
{
"url": "https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d"
},
{
"url": "https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14"
},
{
"url": "https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"
}
],
"title": "Bluetooth: SCO: fix race conditions in sco_sock_connect()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-43023",
"datePublished": "2026-05-01T14:15:25.736Z",
"dateReserved": "2026-05-01T14:12:55.975Z",
"dateUpdated": "2026-08-05T12:25:19.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-43023",
"date": "2026-09-14",
"epss": "0.00097",
"percentile": "0.00825"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-43023\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-01T15:16:46.610\",\"lastModified\":\"2026-06-17T10:48:47.027\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: SCO: fix race conditions in sco_sock_connect()\\n\\nsco_sock_connect() checks sk_state and sk_type without holding\\nthe socket lock. Two concurrent connect() syscalls on the same\\nsocket can both pass the check and enter sco_connect(), leading\\nto use-after-free.\\n\\nThe buggy scenario involves three participants and was confirmed\\nwith additional logging instrumentation:\\n\\n Thread A (connect): HCI disconnect: Thread B (connect):\\n\\n sco_sock_connect(sk) sco_sock_connect(sk)\\n sk_state==BT_OPEN sk_state==BT_OPEN\\n (pass, no lock) (pass, no lock)\\n sco_connect(sk): sco_connect(sk):\\n hci_dev_lock hci_dev_lock\\n hci_connect_sco \u003c- blocked\\n -\u003e hcon1\\n sco_conn_add-\u003econn1\\n lock_sock(sk)\\n sco_chan_add:\\n conn1-\u003esk = sk\\n sk-\u003econn = conn1\\n sk_state=BT_CONNECT\\n release_sock\\n hci_dev_unlock\\n hci_dev_lock\\n sco_conn_del:\\n lock_sock(sk)\\n sco_chan_del:\\n sk-\u003econn=NULL\\n conn1-\u003esk=NULL\\n sk_state=\\n BT_CLOSED\\n SOCK_ZAPPED\\n release_sock\\n hci_dev_unlock\\n (unblocked)\\n hci_connect_sco\\n -\u003e hcon2\\n sco_conn_add\\n -\u003e conn2\\n lock_sock(sk)\\n sco_chan_add:\\n sk-\u003econn=conn2\\n sk_state=\\n BT_CONNECT\\n // zombie sk!\\n release_sock\\n hci_dev_unlock\\n\\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\\nwhen sco_conn_del() cleared the association.\\n\\nFix this by:\\n- Moving lock_sock() before the sk_state/sk_type checks in\\n sco_sock_connect() to serialize concurrent connect attempts\\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\\n return the error instead of just assigning it\\n- Adding a state re-check in sco_connect() after lock_sock()\\n to catch state changes during the window between the locks\\n- Adding sco_pi(sk)-\u003econn check in sco_chan_add() to prevent\\n double-attach of a socket to multiple connections\\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\\n HCI connection leaks\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"70a13b1e25fef37c87c8a1228ddb8900efbca7cf\",\"lessThan\":\"dabf22269242e2f2bf44c43fcdc2fa763df7f9cc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\"lessThan\":\"adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\"lessThan\":\"7e296ffdab5bdab718dff7c14288fdcb9154fa27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\"lessThan\":\"98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\"lessThan\":\"d002bd11024bd231bcb606877e33951ffb7bed14\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3\",\"lessThan\":\"8a5b0135d4a5d9683203a3d9a12a711ccec5936b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6.1.109\",\"lessThan\":\"6.1.168\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.168\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.134\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.81\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.22\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.12\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.109\",\"versionEndExcluding\":\"6.1.168\",\"matchCriteriaId\":\"A4F30D66-D58E-49A0-B69A-36EEB7033DDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.3.1\",\"versionEndExcluding\":\"6.6.134\",\"matchCriteriaId\":\"8DCEDE49-945B-4AC9-8166-D0841A4A8257\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.81\",\"matchCriteriaId\":\"6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.22\",\"matchCriteriaId\":\"C9DF8BCE-36D3-475D-9D21-19E4F02F9029\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.12\",\"matchCriteriaId\":\"0A2B9540-02D5-41B4-B16A-82AF66FD4F36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"21D6F467-B848-453E-B1A4-BEF940E413A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.3:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1240A34-749A-49F5-B8DD-C09441AD2228\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D2315C0-D46F-4F85-9754-F9E5E11374A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-09-02T15:10:28+00:00",
"cve": "CVE-2026-43023",
"id": "CVE-2026-43023",
"initial_release_date": "2026-05-01T00:00:00+00:00",
"product_status:fixed": "1224",
"product_status:known_affected": "22",
"product_status:known_not_affected": "90",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43023.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-08-31T17:11:23Z",
"cve": "CVE-2026-43023",
"id": "CVE-2026-43023",
"initial_release_date": "2026-05-06T01:41:20Z",
"product_status:first_fixed": "2",
"product_status:known_affected": "394",
"product_status:known_not_affected": "294",
"product_status:recommended": "366",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-43023",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-43023.json",
"version": "13"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…