SECUFOCUSNOW
Home›CVE index›CVE-2026-31408
Review reviewHigh

CVE-2026-31408

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a...

CVSS
8.8
EPSS
0.30%
22.3% percentile
CISA KEV
Not listed
Published
2026.04.06
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.30%
Technical severityCVSS 8.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < d57384e27d1ebf0047e3f00a6e1181b8be9857a2, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b0a7da0e3f7442545f071499beb36374714bb9de, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 45aaca995e4a7a05b272a58e7ab2fff4f611b8f1, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 108b81514d8f2535eb16651495cefb2250528db3, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e76e8f0581ef555eacc11dbb095e602fb30a5361, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 598dbba9919c5e36c54fe1709b557d64120cb94b, >= 2.6.12, >= 2.6.12.1 < 5.15.203, >= 5.16 < 6.1.168, >= 6.2 < 6.6.131, >= 6.7 < 6.12.80, >= 6.13 < 6.18.21, >= 6.19 < 6.19.11, 2.6.12, 7.0
Fixed versions
5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416