CVE-2026-89774: Bluetooth: SCO: hold sk properly in sco_conn_ready

[Lee Jones <lee@kernel.org>]

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: hold sk properly in sco_conn_ready

sk deref in sco_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk and parent sk is
currently accessed without either, and without checking parent->sk_state:

    [Task 1]            [Task 2]
                        sco_sock_release
    sco_conn_ready
      sk = conn->sk
                          lock_sock(sk)
                            conn->sk = NULL
      lock_sock(sk)
                          release_sock(sk)
                          sco_sock_kill(sk)
       UAF on sk deref

and similarly for access to sco_get_sock_listen() return value.

Fix possible UAF by holding sk refcount in sco_conn_ready() and making
sco_get_sock_listen() increase refcount. Also recheck after lock_sock
that the socket is still valid.  Adjust conn->sk locking so it's
protected also by lock_sock() of the associated socket if any.

The Linux kernel CVE team has assigned CVE-2026-89774 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 5.15.212 with commit 50aae396dc30377bec8e3b181b8346f8fd38f7d8
	Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.1.178 with commit 6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1
	Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.6.145 with commit d141d9b769bcd1b747898528c5023270cda040f2
	Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.12.97 with commit 73cb063f5ec6ca51eb1e246c6d332563002ac277
	Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.18.40 with commit 7199c78c3a3e399a4dc439d845826793880ccedc
	Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 7.1 with commit 4e37f6452d586b95c346a9abdd2fb80b67794f39

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-89774
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/bluetooth/sco.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/50aae396dc30377bec8e3b181b8346f8fd38f7d8
	https://git.kernel.org/stable/c/6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1
	https://git.kernel.org/stable/c/d141d9b769bcd1b747898528c5023270cda040f2
	https://git.kernel.org/stable/c/73cb063f5ec6ca51eb1e246c6d332563002ac277
	https://git.kernel.org/stable/c/7199c78c3a3e399a4dc439d845826793880ccedc
	https://git.kernel.org/stable/c/4e37f6452d586b95c346a9abdd2fb80b67794f39