Use-After-Free Vulnerability in Linux Kernel Bluetooth Component

CVE-2026-31408

What is CVE-2026-31408?

In the Linux kernel's Bluetooth stack, a vulnerability was identified that involves a use-after-free condition in the sco_recv_frame() function. This occurs because, after acquiring a lock (sco_conn_lock), the function releases it without holding a reference to the socket, leaving room for a concurrent close() operation to free the socket. The oversight leads to a potential use of an invalid memory reference. The resolution involves using sco_sock_hold() to maintain a reference to the socket before the lock release and ensuring to call sock_put() on all exit paths to avoid similar issues in the future.

References