CVE-2026-99011

The Linux kernel is vulnerable to a slab-use-after-free in the Bluetooth SCO subsystem. The issue arises because the sco_recv_scodata() function upgrades a weak back-pointer to a strong reference under hdev->lock, but the pointer is cleared in sco_conn_free() without holding that same lock. Th...

EUVD-2026-108805

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...