859 matches found
CVE-2026-89774
A flaw was found in the Linux kernel's Bluetooth Synchronous Connection-Oriented SCO module. This Use-After-Free UAF vulnerability occurs due to a race condition where the system attempts to use a memory region after it has been freed. A remote attacker could exploit this flaw by initiating a...
Astra Linux – vulnerability in linux-6.18
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: assign the socket its own scoconn reference scoconndel drops a reference it does not own. It takes one transient reference via scoconnholdunlesszero and releases it with scosockhold; the additional put in the !sk...
CVE-2026-99011
A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition between connection termination and incoming data handling in the Synchronous Connection-Oriented SCO protocol can lead to a use-after-free condition. An attacker within Bluetooth range or a local user could exploit this...
kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect()
A flaw was found in the Linux kernel, specifically within its Bluetooth Synchronous Connection-Oriented SCO component. This vulnerability occurs due to race conditions when multiple connection attempts are made simultaneously on the same Bluetooth socket. This can lead to a use-after-free error,...
SUSE CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
Linux Distros Unpatched Vulnerability : CVE-2026-99011
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades t...
CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
DEBIAN-CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
UBUNTU-CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
CVE-2026-99011
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
EUVD-2026-108805
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
CVE-2026-99011
The Linux kernel is affected by a slab-use-after-free vulnerability in the Bluetooth SCO component. The issue arises because sco_recv_scodata() upgrades a weak back-pointer to a strong reference under hdev->lock, but the pointer is cleared by sco_conn_free() without holding that same lock. Thi...
CVE-2026-99011 Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...
Linux kernel security vulnerabilities
A security vulnerability exists in Linux kernel version 6.13. It stems from improper serialization of concurrent access to hcon-scodata by scorecvscodata and scoconnfree within Bluetooth SCO, potentially leading to use-after-free conditions...
Linux Distros Unpatched Vulnerability : CVE-2026-106589
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In sshd in OpenSSH through 10.6, in certain environments such as QNX 6 and SCO OpenServer 5, sshd-session can unexpectedly have root privileges. This is related...
PT-2026-121988
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth SCO implementation where the lifetime of sco conn is not properly serialized against sco recv scodata. The function sco recv scodata attempts to upgrade ...
Astra Linux – vulnerability in linux-6.1, linux-6.12
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: clamp SCO altsetting table indices btusbwork maps the number of active SCO links to USB alternate settings via a three-entry lookup table when CVSD traffic uses transparent voice settings. Currently, the lookup...
Astra Linux – vulnerability in linux-6.1, linux-6.12
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fixed use-after-free in scorecvframe due to missing sockhold scorecvframe reads conn-sk under scoconnlock, but immediately releases the lock without holding a reference to the socket. A concurrent close call can...