Race Condition in Linux Kernel Bluetooth Functionality

CVE-2026-43023

What is CVE-2026-43023?

In the Linux kernel, a vulnerability has been identified within the Bluetooth subsystem that can lead to a use-after-free condition due to improper socket state checks during concurrent connection attempts. Specifically, the function sco_sock_connect() fails to hold the necessary socket lock while checking the socket state and type. As a result, two threads can simultaneously initiate connection requests on the same socket, leading to inconsistent socket states and potential memory management issues. This race condition may allow a socket that should have been closed to be reused improperly, resulting in memory leaks and crashes. The vulnerability has been addressed by modifying the locking mechanism in sco_sock_connect() to ensure serialized access for connection attempts, thereby mitigating the risk of exploit.

References