{"id":"CVE-2026-43023","state":"PUBLISHED","title":"Bluetooth: SCO: fix race conditions in sco_sock_connect()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n  Thread A (connect):    HCI disconnect:      Thread B (connect):\n\n  sco_sock_connect(sk)                        sco_sock_connect(sk)\n  sk_state==BT_OPEN                           sk_state==BT_OPEN\n  (pass, no lock)                             (pass, no lock)\n  sco_connect(sk):                            sco_connect(sk):\n    hci_dev_lock                                hci_dev_lock\n    hci_connect_sco                               <- blocked\n      -> hcon1\n    sco_conn_add->conn1\n    lock_sock(sk)\n    sco_chan_add:\n      conn1->sk = sk\n      sk->conn = conn1\n    sk_state=BT_CONNECT\n    release_sock\n    hci_dev_unlock\n                           hci_dev_lock\n                           sco_conn_del:\n                             lock_sock(sk)\n                             sco_chan_del:\n                               sk->conn=NULL\n                               conn1->sk=NULL\n                               sk_state=\n                                 BT_CLOSED\n                               SOCK_ZAPPED\n                             release_sock\n                           hci_dev_unlock\n                                                  (unblocked)\n                                                  hci_connect_sco\n                                                    -> hcon2\n                                                  sco_conn_add\n                                                    -> conn2\n                                                  lock_sock(sk)\n                                                  sco_chan_add:\n                                                    sk->conn=conn2\n                                                  sk_state=\n                                                    BT_CONNECT\n                                                  // zombie sk!\n                                                  release_sock\n                                                  hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n  sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n  return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n  to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n  double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n  HCI connection leaks","publishedAt":"2026-05-01T14:15:25.736Z","updatedAt":"2026-10-19T19:06:09.917Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"70a13b1e25fef37c87c8a1228ddb8900efbca7cf","status":"affected","lessThan":"dabf22269242e2f2bf44c43fcdc2fa763df7f9cc","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"7e296ffdab5bdab718dff7c14288fdcb9154fa27","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"d002bd11024bd231bcb606877e33951ffb7bed14","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"8a5b0135d4a5d9683203a3d9a12a711ccec5936b","versionType":"git"},{"version":"6.1.109","status":"affected","lessThan":"6.1.168","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/sco.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.134","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.81","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.22","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.12","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/sco.c"]}],"references":["https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc","https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0","https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27","https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d","https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14","https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"],"weaknesses":["CWE-362"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/43xxx/CVE-2026-43023.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-43023","state":"PUBLISHED","datePublished":"2026-05-01T14:15:25.736Z","dateUpdated":"2026-10-19T19:06:09.917Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-05-01T14:12:55.975Z"},"containers":{"cna":{"title":"Bluetooth: SCO: fix race conditions in sco_sock_connect()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n  Thread A (connect):    HCI disconnect:      Thread B (connect):\n\n  sco_sock_connect(sk)                        sco_sock_connect(sk)\n  sk_state==BT_OPEN                           sk_state==BT_OPEN\n  (pass, no lock)                             (pass, no lock)\n  sco_connect(sk):                            sco_connect(sk):\n    hci_dev_lock                                hci_dev_lock\n    hci_connect_sco                               <- blocked\n      -> hcon1\n    sco_conn_add->conn1\n    lock_sock(sk)\n    sco_chan_add:\n      conn1->sk = sk\n      sk->conn = conn1\n    sk_state=BT_CONNECT\n    release_sock\n    hci_dev_unlock\n                           hci_dev_lock\n                           sco_conn_del:\n                             lock_sock(sk)\n                             sco_chan_del:\n                               sk->conn=NULL\n                               conn1->sk=NULL\n                               sk_state=\n                                 BT_CLOSED\n                               SOCK_ZAPPED\n                             release_sock\n                           hci_dev_unlock\n                                                  (unblocked)\n                                                  hci_connect_sco\n                                                    -> hcon2\n                                                  sco_conn_add\n                                                    -> conn2\n                                                  lock_sock(sk)\n                                                  sco_chan_add:\n                                                    sk->conn=conn2\n                                                  sk_state=\n                                                    BT_CONNECT\n                                                  // zombie sk!\n                                                  release_sock\n                                                  hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n  sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n  return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n  to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n  double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n  HCI connection leaks"}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"70a13b1e25fef37c87c8a1228ddb8900efbca7cf","status":"affected","lessThan":"dabf22269242e2f2bf44c43fcdc2fa763df7f9cc","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"7e296ffdab5bdab718dff7c14288fdcb9154fa27","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"d002bd11024bd231bcb606877e33951ffb7bed14","versionType":"git"},{"version":"9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3","status":"affected","lessThan":"8a5b0135d4a5d9683203a3d9a12a711ccec5936b","versionType":"git"},{"version":"6.1.109","status":"affected","lessThan":"6.1.168","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/sco.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.3","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.3","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.134","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.81","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.22","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.12","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/bluetooth/sco.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc"},{"url":"https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0"},{"url":"https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27"},{"url":"https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d"},{"url":"https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14"},{"url":"https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable code is reached through the local connect() syscall on an AF_BLUETOOTH/SCO socket. A Bluetooth peer or HCI disconnect can influence timing, but an adjacent attacker alone cannot race two connect() calls on the same local socket.\nAC:L - The attacker can create the race by issuing concurrent connect() syscalls on the same socket and repeating attempts while the normal HCI failure/disconnect path runs. Under the higher-severity rule, this attacker-controlled race is Low complexity.\nPR:L - SCO socket creation and connect do not impose a capability check, though AF_BLUETOOTH is limited to init_net rather than unprivileged network namespaces. A basic unprivileged local user on the host can open and race BTPROTO_SCO sockets.\nUI:N - No victim action is required once the attacker can run local code. The attacker directly invokes socket/connect operations and can repeat the race.\nS:U - The bug corrupts kernel Bluetooth socket/connection state within the same kernel security authority. It is a standard local kernel compromise/DoS path, not a VM escape or cross-scope boundary bypass.\nC:H - The race leads to a use-after-free/double sock_put on kernel socket objects. Kernel UAFs are defensibly scored as high confidentiality impact because freed objects can be reused for information disclosure primitives.\nI:H - The same UAF/double-free condition can be leveraged through heap reuse and spraying to corrupt kernel objects or control flow. Under the required guidance, UAF memory corruption is High integrity impact.\nA:H - Even without full exploitation, the double sock_put/use-after-free can crash or destabilize the kernel. Kernel crashes and UAF-triggered oops/panic conditions are High availability impact."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:25:19.630Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.109","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.6.134"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.12.81"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.18.22"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"6.19.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.3","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-43023","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:13:36.010372Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-362","lang":"en","type":"CWE","description":"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T19:06:09.917Z"}}]}}}