Executive brief
A vulnerability was identified in the Linux kernel's Bluetooth subsystem that could allow an attacker to crash the system or potentially execute unauthorized code. The issue occurs when the system handles Synchronous Connection-Oriented (SCO) Bluetooth connections, which are typically used for voice data. An exploit could lead to a complete system failure or a breach of data integrity and confidentiality.
Technical details
A use-after-free (UAF) vulnerability exists in net/bluetooth/sco.c within the Linux kernel. The flaw is triggered during the cleanup of SCO connections (sco_conn_free) where a socket pointer is accessed after the underlying memory has been freed. This occurs because sco_sock_kill did not properly nullify the connection's reference to the socket. An attacker with adjacent network access (Bluetooth range) and basic privileges could exploit this race condition or improper state management to cause a kernel panic or achieve elevated execution. The issue has been resolved by ensuring the connection's socket reference is set to NULL when the socket is killed.
Affected products
- Linux Linux versions before 6.13-rc1
Timeline
- 2025-09-22: patched: Initial patch authored by Luiz Augusto von Dentz
- 2025-12-08: advisory: CVE published