{"id":"CVE-2026-43023","title":"Bluetooth: SCO: fix race conditions in sco_sock_connect()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() sysc…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 70a13b1e25fef37c87c8a1228ddb8900efbca7cf < dabf22269242e2f2bf44c43fcdc2fa763df7f9cc","Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0","Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < 7e296ffdab5bdab718dff7c14288fdcb9154fa27","Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < 98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d","Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < d002bd11024bd231bcb606877e33951ffb7bed14","Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < 8a5b0135d4a5d9683203a3d9a12a711ccec5936b","Linux >= 6.1.109 < 6.1.168","Linux 6.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:13:36.010372Z"},"published":"2026-05-01","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:28.387Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43023","references":[{"url":"https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc"},{"url":"https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0"},{"url":"https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27"},{"url":"https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d"},{"url":"https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14"},{"url":"https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"}],"tags":["cve.org"],"epss":0.00097,"epssPercentile":0.007,"ingestedAt":"2026-10-16T17:24:46.677Z","slug":"CVE-2026-43023","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n  Thread A (connect):    HCI disconnect:      Thread B (connect):\n\n  sco_sock_connect(sk)                        sco_sock_connect(sk)\n  sk_state==BT_OPEN                           sk_state==BT_OPEN\n  (pass, no lock)                             (pass, no lock)\n  sco_connect(sk):                            sco_connect(sk):\n    hci_dev_lock                                hci_dev_lock\n    hci_connect_sco                               <- blocked\n      -> hcon1\n    sco_conn_add->conn1\n    lock_sock(sk)\n    sco_chan_add:\n      conn1->sk = sk\n      sk->conn = conn1\n    sk_state=BT_CONNECT\n    release_sock\n    hci_dev_unlock\n                           hci_dev_lock\n                           sco_conn_del:\n                             lock_sock(sk)\n                             sco_chan_del:\n                               sk->conn=NULL\n                               conn1->sk=NULL\n                               sk_state=\n                                 BT_CLOSED\n                               SOCK_ZAPPED\n                             release_sock\n                           hci_dev_unlock\n                                                  (unblocked)\n                                                  hci_connect_sco\n                                                    -> hcon2\n                                                  sco_conn_add\n                                                    -> conn2\n                                                  lock_sock(sk)\n                                                  sco_chan_add:\n                                                    sk->conn=conn2\n                                                  sk_state=\n                                                    BT_CONNECT\n                                                  // zombie sk!\n                                                  release_sock\n                                                  hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n  sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n  return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n  to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n  double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n  HCI connection leaks\n\n## Affected\n\n- `Linux >= 70a13b1e25fef37c87c8a1228ddb8900efbca7cf < dabf22269242e2f2bf44c43fcdc2fa763df7f9cc`\n- `Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0`\n- `Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < 7e296ffdab5bdab718dff7c14288fdcb9154fa27`\n- `Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < 98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d`\n- `Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < d002bd11024bd231bcb606877e33951ffb7bed14`\n- `Linux >= 9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3 < 8a5b0135d4a5d9683203a3d9a12a711ccec5936b`\n- `Linux >= 6.1.109 < 6.1.168`\n- `Linux 6.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}