GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80683 (GCVE-0-2026-80683)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:52 – Updated: 2026-08-29 06:22
VLAI
Title
Bluetooth: SCO: give the socket its own sco_conn reference
Summary
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: give the socket its own sco_conn reference sco_conn_del() drops a reference it does not own. It takes one transient reference via sco_conn_hold_unless_zero() and releases it with the sco_conn_put() that follows sco_sock_hold(); the additional put in the !sk branch releases a second one: conn = sco_conn_hold_unless_zero(conn); ... sk = sco_sock_hold(conn); sco_conn_unlock(conn); sco_conn_put(conn); if (!sk) { sco_conn_put(conn); return; } When close() races the controller's Disconnection Complete, sco_chan_del() clears conn->sk and drops the socket's reference while sco_conn_del() is running. sco_conn_del() then sees sk == NULL, its own put drops the count to zero and frees the conn, and the second put writes to the freed kref: BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190 Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413 Workqueue: hci1 hci_rx_work Call Trace: sco_conn_put.part.0+0x1a/0x190 hci_disconn_complete_evt+0x1ee/0x3e0 hci_event_packet+0x54a/0x650 hci_rx_work+0x321/0x3d0 Allocated by task 413: sco_conn_add+0x72/0x1a0 sco_connect_cfm+0x88/0x670 Freed by task 413: sco_conn_del.isra.0+0x3f/0xf0 hci_disconn_complete_evt+0x1ee/0x3e0 refcount_t: underflow; use-after-free. The root cause is that the socket stores the connection without holding a reference of its own. __sco_chan_add() does: sco_pi(sk)->conn = conn; so the socket borrows whatever reference its caller happened to hold, and the callers paper over that with ad-hoc holds and puts. Give the socket a counted reference instead: __sco_chan_add() takes one and it is released together with the channel (sco_chan_del()) and in sco_sock_destruct(). With the socket holding its own reference, sco_conn_del() no longer needs the extra put and the redundant hold in sco_conn_ready() goes away. Making the socket own its reference means the connection is now actually freed on the error paths of sco_connect() where it used to leak, which in turn runs sco_conn_free() and its hci_conn_drop(conn->hcon). To keep the hci_conn accounting balanced, make that ownership explicit as well: sco_conn_add() consumes one hci_conn reference and the sco_conn owns it for its lifetime. sco_connect() hands over the reference returned by hci_connect_sco() and no longer drops it on the error paths; sco_connect_cfm(), which is not given a reference, takes one with hci_conn_hold() before handing it to sco_conn_add() (and drops it again if the allocation fails); and the explicit hci_conn_hold() in sco_conn_ready() is removed. Every reference then has a single, clear owner.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: e6720779ae612a14ac4ba7fe4fd5b27d900d932c , < a33bc07b4730b6cd5681ac77d18ae0de3e739690 (git)
Affected: e6720779ae612a14ac4ba7fe4fd5b27d900d932c , < 8fe627192fa5da7157f9a48608f13c04b6373e43 (git)
Affected: e6720779ae612a14ac4ba7fe4fd5b27d900d932c , < abd93c85c8667add738ee82aeab95dd9fc8265a2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a33bc07b4730b6cd5681ac77d18ae0de3e739690",
              "status": "affected",
              "version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c",
              "versionType": "git"
            },
            {
              "lessThan": "8fe627192fa5da7157f9a48608f13c04b6373e43",
              "status": "affected",
              "version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c",
              "versionType": "git"
            },
            {
              "lessThan": "abd93c85c8667add738ee82aeab95dd9fc8265a2",
              "status": "affected",
              "version": "e6720779ae612a14ac4ba7fe4fd5b27d900d932c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bluetooth/sco.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: give the socket its own sco_conn reference\n\nsco_conn_del() drops a reference it does not own. It takes one transient\nreference via sco_conn_hold_unless_zero() and releases it with the\nsco_conn_put() that follows sco_sock_hold(); the additional put in the\n!sk branch releases a second one:\n\n    conn = sco_conn_hold_unless_zero(conn);\n    ...\n    sk = sco_sock_hold(conn);\n    sco_conn_unlock(conn);\n    sco_conn_put(conn);\n\n    if (!sk) {\n            sco_conn_put(conn);\n            return;\n    }\n\nWhen close() races the controller\u0027s Disconnection Complete, sco_chan_del()\nclears conn-\u003esk and drops the socket\u0027s reference while sco_conn_del() is\nrunning. sco_conn_del() then sees sk == NULL, its own put drops the count\nto zero and frees the conn, and the second put writes to the freed kref:\n\n    BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190\n    Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413\n    Workqueue: hci1 hci_rx_work\n    Call Trace:\n     sco_conn_put.part.0+0x1a/0x190\n     hci_disconn_complete_evt+0x1ee/0x3e0\n     hci_event_packet+0x54a/0x650\n     hci_rx_work+0x321/0x3d0\n    Allocated by task 413:\n     sco_conn_add+0x72/0x1a0\n     sco_connect_cfm+0x88/0x670\n    Freed by task 413:\n     sco_conn_del.isra.0+0x3f/0xf0\n     hci_disconn_complete_evt+0x1ee/0x3e0\n    refcount_t: underflow; use-after-free.\n\nThe root cause is that the socket stores the connection without holding a\nreference of its own. __sco_chan_add() does:\n\n    sco_pi(sk)-\u003econn = conn;\n\nso the socket borrows whatever reference its caller happened to hold, and\nthe callers paper over that with ad-hoc holds and puts. Give the socket a\ncounted reference instead: __sco_chan_add() takes one and it is released\ntogether with the channel (sco_chan_del()) and in sco_sock_destruct().\nWith the socket holding its own reference, sco_conn_del() no longer needs\nthe extra put and the redundant hold in sco_conn_ready() goes away.\n\nMaking the socket own its reference means the connection is now actually\nfreed on the error paths of sco_connect() where it used to leak, which in\nturn runs sco_conn_free() and its hci_conn_drop(conn-\u003ehcon). To keep the\nhci_conn accounting balanced, make that ownership explicit as well:\nsco_conn_add() consumes one hci_conn reference and the sco_conn owns it for\nits lifetime. sco_connect() hands over the reference returned by\nhci_connect_sco() and no longer drops it on the error paths;\nsco_connect_cfm(), which is not given a reference, takes one with\nhci_conn_hold() before handing it to sco_conn_add() (and drops it again if\nthe allocation fails); and the explicit hci_conn_hold() in sco_conn_ready()\nis removed. Every reference then has a single, clear owner."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The UAF is triggered in sco_conn_del() from hci_disconn_complete_evt on hci_rx_work when the Bluetooth controller reports SCO/eSCO teardown, which is driven by an in-range peer disconnect; Bluetooth SCO is an adjacent-radio protocol path, not a local-only syscall entry point.\nAC:L - The failure is a close()-versus-Disconnection-Complete race where the attacker controls both sides by concurrently closing the SCO socket while inducing HCI disconnect (local threads or a nearby peer hanging up), and can repeat connect/disconnect cycles until the window is hit.\nPR:N - An adjacent Bluetooth peer can send the disconnect that produces Disconnection Complete without any Linux credentials on the victim, and SCO sockets have no capability gate; only an active SCO session on init_net is needed, not root or CAP_NET_ADMIN.\nUI:N - Exploitation does not require victim interaction beyond an already-active SCO link (headset/call); the attacker can time peer-initiated disconnects against automatic socket teardown without social engineering or manual victim steps.\nS:U - The refcount use-after-free corrupts kernel Bluetooth connection state within the same kernel security authority; it is standard kernel memory corruption, not a VM escape, IOMMU bypass, or other cross-scope boundary violation.\nC:H - sco_conn_del() performs a double sco_conn_put() that writes to a freed kref (4-byte slab UAF), enabling heap reuse and arbitrary kernel memory disclosure primitives consistent with kernel use-after-free confidentiality impact.\nI:H - The post-free kref decrement is a controlled kernel heap write that can be groomed via repeated SCO connect/close and disconnect cycles to corrupt adjacent slab objects and achieve arbitrary write or control-flow hijack.\nA:H - The bug reliably triggers kernel KASAN slab-use-after-free and refcount underflow on hci_rx_work during disconnect handling, producing oops/panic, and can be retriggered to deny service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:22:10.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a33bc07b4730b6cd5681ac77d18ae0de3e739690"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fe627192fa5da7157f9a48608f13c04b6373e43"
        },
        {
          "url": "https://git.kernel.org/stable/c/abd93c85c8667add738ee82aeab95dd9fc8265a2"
        }
      ],
      "title": "Bluetooth: SCO: give the socket its own sco_conn reference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80683",
    "datePublished": "2026-08-28T06:52:50.099Z",
    "dateReserved": "2026-08-26T14:34:25.784Z",
    "dateUpdated": "2026-08-29T06:22:10.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80683",
      "date": "2026-09-15",
      "epss": "0.00235",
      "percentile": "0.14592"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80683\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:53.737\",\"lastModified\":\"2026-08-29T07:16:50.850\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nBluetooth: SCO: give the socket its own sco_conn reference\\n\\nsco_conn_del() drops a reference it does not own. It takes one transient\\nreference via sco_conn_hold_unless_zero() and releases it with the\\nsco_conn_put() that follows sco_sock_hold(); the additional put in the\\n!sk branch releases a second one:\\n\\n    conn = sco_conn_hold_unless_zero(conn);\\n    ...\\n    sk = sco_sock_hold(conn);\\n    sco_conn_unlock(conn);\\n    sco_conn_put(conn);\\n\\n    if (!sk) {\\n            sco_conn_put(conn);\\n            return;\\n    }\\n\\nWhen close() races the controller\u0027s Disconnection Complete, sco_chan_del()\\nclears conn-\u003esk and drops the socket\u0027s reference while sco_conn_del() is\\nrunning. sco_conn_del() then sees sk == NULL, its own put drops the count\\nto zero and frees the conn, and the second put writes to the freed kref:\\n\\n    BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190\\n    Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413\\n    Workqueue: hci1 hci_rx_work\\n    Call Trace:\\n     sco_conn_put.part.0+0x1a/0x190\\n     hci_disconn_complete_evt+0x1ee/0x3e0\\n     hci_event_packet+0x54a/0x650\\n     hci_rx_work+0x321/0x3d0\\n    Allocated by task 413:\\n     sco_conn_add+0x72/0x1a0\\n     sco_connect_cfm+0x88/0x670\\n    Freed by task 413:\\n     sco_conn_del.isra.0+0x3f/0xf0\\n     hci_disconn_complete_evt+0x1ee/0x3e0\\n    refcount_t: underflow; use-after-free.\\n\\nThe root cause is that the socket stores the connection without holding a\\nreference of its own. __sco_chan_add() does:\\n\\n    sco_pi(sk)-\u003econn = conn;\\n\\nso the socket borrows whatever reference its caller happened to hold, and\\nthe callers paper over that with ad-hoc holds and puts. Give the socket a\\ncounted reference instead: __sco_chan_add() takes one and it is released\\ntogether with the channel (sco_chan_del()) and in sco_sock_destruct().\\nWith the socket holding its own reference, sco_conn_del() no longer needs\\nthe extra put and the redundant hold in sco_conn_ready() goes away.\\n\\nMaking the socket own its reference means the connection is now actually\\nfreed on the error paths of sco_connect() where it used to leak, which in\\nturn runs sco_conn_free() and its hci_conn_drop(conn-\u003ehcon). To keep the\\nhci_conn accounting balanced, make that ownership explicit as well:\\nsco_conn_add() consumes one hci_conn reference and the sco_conn owns it for\\nits lifetime. sco_connect() hands over the reference returned by\\nhci_connect_sco() and no longer drops it on the error paths;\\nsco_connect_cfm(), which is not given a reference, takes one with\\nhci_conn_hold() before handing it to sco_conn_add() (and drops it again if\\nthe allocation fails); and the explicit hci_conn_hold() in sco_conn_ready()\\nis removed. Every reference then has a single, clear owner.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e6720779ae612a14ac4ba7fe4fd5b27d900d932c\",\"lessThan\":\"a33bc07b4730b6cd5681ac77d18ae0de3e739690\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e6720779ae612a14ac4ba7fe4fd5b27d900d932c\",\"lessThan\":\"8fe627192fa5da7157f9a48608f13c04b6373e43\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e6720779ae612a14ac4ba7fe4fd5b27d900d932c\",\"lessThan\":\"abd93c85c8667add738ee82aeab95dd9fc8265a2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bluetooth/sco.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/8fe627192fa5da7157f9a48608f13c04b6373e43\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a33bc07b4730b6cd5681ac77d18ae0de3e739690\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/abd93c85c8667add738ee82aeab95dd9fc8265a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-02T07:45:44+00:00",
      "cve": "CVE-2026-80683",
      "id": "CVE-2026-80683",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Bluetooth: SCO: give the socket its own sco_conn reference",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80683.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-28T16:34:15Z",
      "cve": "CVE-2026-80683",
      "id": "CVE-2026-80683",
      "initial_release_date": "2026-08-28T16:34:15Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80683",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80683.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.