CVE-2026-89774

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/4e37f6452d586b95c346a9abdd2fb80b67794f39
https://git.kernel.org/stable/c/50aae396dc30377bec8e3b181b8346f8fd38f7d8
https://git.kernel.org/stable/c/6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1
https://git.kernel.org/stable/c/7199c78c3a3e399a4dc439d845826793880ccedc
https://git.kernel.org/stable/c/73cb063f5ec6ca51eb1e246c6d332563002ac277
https://git.kernel.org/stable/c/d141d9b769bcd1b747898528c5023270cda040f2

Configurations

No configuration.

History

16 Sep 2026, 15:18

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 8.8

Information

Published : 2026-09-16 09:17

Updated : 2026-09-16 15:18

NVD link : CVE-2026-89774

Mitre link : CVE-2026-89774

CVE.ORG link : CVE-2026-89774

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-89774", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "50aae396dc30377bec8e3b181b8346f8fd38f7d8", "versionType": "git"}, {"status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1", "versionType": "git"}, {"status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "d141d9b769bcd1b747898528c5023270cda040f2", "versionType": "git"}, {"status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "73cb063f5ec6ca51eb1e246c6d332563002ac277", "versionType": "git"}, {"status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "7199c78c3a3e399a4dc439d845826793880ccedc", "versionType": "git"}, {"status": "affected", "version": "27c24fda62b601d6f9ca5e992502578c4310876f", "lessThan": "4e37f6452d586b95c346a9abdd2fb80b67794f39", "versionType": "git"}], "programFiles": ["net/bluetooth/sco.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/sco.c"], "defaultStatus": "affected"}]}], "published": "2026-09-16T09:17:07.717", "references": [{"url": "https://git.kernel.org/stable/c/4e37f6452d586b95c346a9abdd2fb80b67794f39", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/50aae396dc30377bec8e3b181b8346f8fd38f7d8", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7199c78c3a3e399a4dc439d845826793880ccedc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/73cb063f5ec6ca51eb1e246c6d332563002ac277", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d141d9b769bcd1b747898528c5023270cda040f2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: hold sk properly in sco_conn_ready\n\nsk deref in sco_conn_ready must be done either under conn->lock, or\nholding a refcount, to avoid concurrent close. conn->sk and parent sk is\ncurrently accessed without either, and without checking parent->sk_state:\n\n [Task 1] [Task 2]\n sco_sock_release\n sco_conn_ready\n sk = conn->sk\n lock_sock(sk)\n conn->sk = NULL\n lock_sock(sk)\n release_sock(sk)\n sco_sock_kill(sk)\n UAF on sk deref\n\nand similarly for access to sco_get_sock_listen() return value.\n\nFix possible UAF by holding sk refcount in sco_conn_ready() and making\nsco_get_sock_listen() increase refcount. Also recheck after lock_sock\nthat the socket is still valid. Adjust conn->sk locking so it's\nprotected also by lock_sock() of the associated socket if any."}], "lastModified": "2026-09-16T15:18:06.747", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}