Executive brief
The Linux kernel's Bluetooth SCO (Synchronous Connection-Oriented) socket implementation contains a race condition that can cause system deadlock. When a socket is closed while a timeout handler is running, both threads attempt to acquire the same lock twice, freezing system operations related to Bluetooth SCO connections.
Technical details
The vulnerability is a classic deadlock race condition in the Bluetooth SCO socket implementation. The sco_sock_timeout() timer handler and sco_sock_close() function both call lock_sock(sk) to acquire the socket lock. When a socket close operation triggers disable_delayed_work_sync() on the timeout work while holding the socket lock, the timeout handler—which also needs the same lock—cannot proceed, creating a circular lock dependency. The fix relocates disable_delayed_work_sync() outside the lock_sock(sk) protected section to prevent the double-lock scenario. This is a kernel-level deadlock affecting Bluetooth SCO functionality, requiring a patched kernel to resolve.
Affected products
- Linux Linux kernel 6.13.0-rc4 and likely earlier versions
Timeline
- 2026-08-28: disclosed