From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 654D146AF2C for ; Wed, 16 Sep 2026 08:25:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789547131; cv=none; b=FiCBErwzy8MIM8PgnHkCIqthVoaiJp4hxU0zPbnu22nD6aOQRM5Mm7wlLoByVaLnLJVZryjZk1XDAWVfdGALY78j0s6L6L9jdPk1Ja7EjrMfE1HimoVGQIh2+K6PZ9ckoRiE4cdfpFMMG+Mu934XINgvZ7n+P4vYM5a/VGo5N0c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789547131; c=relaxed/simple; bh=LGhKL1taJLsmCXfbyIJIL50fVmNM+ae9Z+pMGxyKNx4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bReSI/vkA3jObtJMq92TZ5CM7WquaBGT0s2tGSYbM4nzwrT3vxPwaDYOfcsp8/o0XlIlKpfeCKC5vv/wzSq7UI0STRSxQ28lcHoF80UtP7jG/UwHW6qBtgMIDzGyqUCYAMUehyDPuO4tczip981aDznlr9Cp2WXKeuVJWes4S38= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=g0KJFTbU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="g0KJFTbU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 703EF1F00899; Wed, 16 Sep 2026 08:25:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789547123; bh=Gzr4qqnFi1KfwgY9aLr7QDqTRqOj6h2H2pAD9hWjDi8=; h=From:To:Cc:Subject:Date:Reply-To; b=g0KJFTbUpDvEzr+Mgqg2FwEHHTrLIpRLYj+dLjZFeerlj+wVvayjjD5jRvKPYUvPB bidOu6UC9xuYz72dYERjGrOIKD/9DpNZRFcPI0APkb+HxCbEOTvzNnYTqEEWTXjy9F unCaaeBy9Hvh3RMGqB6On0TpaL+Fbi+UarUUEjcFnfbszvIrlVqMd5HIjh0rDbZXYe XdlMwTMvGTpb3PPr5zKCHDODM08A/S8pffX0lzGi0d5RoF0Xj2S6Qtk2f1VktgEN/a jUnVfL5dlleepKcUsX6Nit9BEevrBVnqVAwx0WqOxre9DUYR3vOM9jqJzR9uufbITR TXdmhKeJO67XA== From: Lee Jones To: linux-cve-announce@vger.kernel.org Cc: Lee Jones Subject: CVE-2026-89774: Bluetooth: SCO: hold sk properly in sco_conn_ready Date: Wed, 16 Sep 2026 09:25:04 +0100 Message-ID: <20260916082503.1360106-2-lee@kernel.org> X-Mailer: git-send-email 2.55.0.1032.g73a4cd73de-goog Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3567; i=lee@kernel.org; h=from:subject; bh=LGhKL1taJLsmCXfbyIJIL50fVmNM+ae9Z+pMGxyKNx4=; b=owEBbQKS/ZANAwAKAVGvii+H/HdhAcsmYgBqqlJfJx/C/gr1WDTifK0ITxc/zcajnhUQTTn2P ol+x1RhKSSJAjMEAAEKAB0WIQR2tsk1o74gmpTwh0hRr4ovh/x3YQUCaqpSXwAKCRBRr4ovh/x3 YQdgD/9BXGIzthMQvz1xuLpdQLQrhSHaY3GcY8fjE4F89P1MqaytVWmfd07BSV+39ozxuYb66XG 0wJw9rLJfwk63OPsJBvUPpEoQ3RLIa6kU9KG3bzXmZQmN2hPn8OBNJHcK4upWynYSBIIZAO4Kva yRgIEkQQgReUw4x+QSP4DktaVin4hNMhm3y6+G1nLRsoO9uaea8JQmOPDbadbmBW0JWbo2BfaOp XoZvQNMh4pxHiRdO5FwiegfDKkdDz/ErenPHoY3V/JgsDICN3TgF02QbDZ3df0ziwLX07rTLsp8 z+sbdJx01AvdrQ1C+CjXq0SHE64p9bVWfKxKG/oZIj04uc2Gd5uQkewqjJOaV8H0pqQ/zFXbpFA 6WKU5METWcmYuvUxZ9YwUS+wMhz17YBULU9NvHVByQAsf3sp404GFt/bkW5y+7S1XqIQxliLU4K Tc+aXPnVF5X3gmSfkw/0icHX6y+yYbXY9ZJHNpLDiYhKc+Lv4zPiY5NI2hKZeD8FsieWSQzYSAE i+iDcF08dxsIIzcOrqOLKueMdR1vDJtkBY6VrUGiETmLo6sQfhI8tto/aTih98pbtAk49G/tzfX YnRPDRC5j1cKCY7GQTBnv8Awv+eTFez1wBjecdZhCqra3f4nQlxyIY1vUO5pqSVJQXMpPuffBcI 7pu9onaDlNkzMqg== X-Developer-Key: i=lee@kernel.org; a=openpgp; fpr=76B6C935A3BE209A94F0874851AF8A2F87FC7761 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any. The Linux kernel CVE team has assigned CVE-2026-89774 to this issue. Affected and fixed versions =========================== Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 5.15.212 with commit 50aae396dc30377bec8e3b181b8346f8fd38f7d8 Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.1.178 with commit 6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1 Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.6.145 with commit d141d9b769bcd1b747898528c5023270cda040f2 Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.12.97 with commit 73cb063f5ec6ca51eb1e246c6d332563002ac277 Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 6.18.40 with commit 7199c78c3a3e399a4dc439d845826793880ccedc Issue introduced in 5.15 with commit 27c24fda62b601d6f9ca5e992502578c4310876f and fixed in 7.1 with commit 4e37f6452d586b95c346a9abdd2fb80b67794f39 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89774 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/bluetooth/sco.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/50aae396dc30377bec8e3b181b8346f8fd38f7d8 https://git.kernel.org/stable/c/6e3840578aaad1a296aab1eaaa89ea3b7d5cbae1 https://git.kernel.org/stable/c/d141d9b769bcd1b747898528c5023270cda040f2 https://git.kernel.org/stable/c/73cb063f5ec6ca51eb1e246c6d332563002ac277 https://git.kernel.org/stable/c/7199c78c3a3e399a4dc439d845826793880ccedc https://git.kernel.org/stable/c/4e37f6452d586b95c346a9abdd2fb80b67794f39