CVE-2026-80683

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: give the socket its own sco_conn reference

sco_conn_del() drops a reference it does not own. It takes one transient

reference via sco_conn_hold_unless_zero() and releases it with the

sco_conn_put() that follows sco_sock_hold(); the additional put in the

!sk branch releases a second one:

conn = sco_conn_hold_unless_zero(conn);

...

sk = sco_sock_hold(conn);

sco_conn_unlock(conn);

sco_conn_put(conn);

if (!sk) {

sco_conn_put(conn);

return;

}

When close() races the controller's Disconnection Complete, sco_chan_del()

clears conn->sk and drops the socket's reference while sco_conn_del() is

running. sco_conn_del() then sees sk == NULL, its own put drops the count

to zero and frees the conn, and the second put writes to the freed kref:

BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190

Write of size 4 at addr ffff8881099dec74 by tas

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References