CVE-2026-43023

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43023", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.975Z", "datePublished": "2026-05-01T14:15:25.736Z", "dateUpdated": "2026-10-19T19:06:09.917Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:19.630Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n Thread A (connect): HCI disconnect: Thread B (connect):\n\n sco_sock_connect(sk) sco_sock_connect(sk)\n sk_state==BT_OPEN sk_state==BT_OPEN\n (pass, no lock) (pass, no lock)\n sco_connect(sk): sco_connect(sk):\n hci_dev_lock hci_dev_lock\n hci_connect_sco <- blocked\n -> hcon1\n sco_conn_add->conn1\n lock_sock(sk)\n sco_chan_add:\n conn1->sk = sk\n sk->conn = conn1\n sk_state=BT_CONNECT\n release_sock\n hci_dev_unlock\n hci_dev_lock\n sco_conn_del:\n lock_sock(sk)\n sco_chan_del:\n sk->conn=NULL\n conn1->sk=NULL\n sk_state=\n BT_CLOSED\n SOCK_ZAPPED\n release_sock\n hci_dev_unlock\n (unblocked)\n hci_connect_sco\n -> hcon2\n sco_conn_add\n -> conn2\n lock_sock(sk)\n sco_chan_add:\n sk->conn=conn2\n sk_state=\n BT_CONNECT\n // zombie sk!\n release_sock\n hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n HCI connection leaks"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the local connect() syscall on an AF_BLUETOOTH/SCO socket. A Bluetooth peer or HCI disconnect can influence timing, but an adjacent attacker alone cannot race two connect() calls on the same local socket.\nAC:L - The attacker can create the race by issuing concurrent connect() syscalls on the same socket and repeating attempts while the normal HCI failure/disconnect path runs. Under the higher-severity rule, this attacker-controlled race is Low complexity.\nPR:L - SCO socket creation and connect do not impose a capability check, though AF_BLUETOOTH is limited to init_net rather than unprivileged network namespaces. A basic unprivileged local user on the host can open and race BTPROTO_SCO sockets.\nUI:N - No victim action is required once the attacker can run local code. The attacker directly invokes socket/connect operations and can repeat the race.\nS:U - The bug corrupts kernel Bluetooth socket/connection state within the same kernel security authority. It is a standard local kernel compromise/DoS path, not a VM escape or cross-scope boundary bypass.\nC:H - The race leads to a use-after-free/double sock_put on kernel socket objects. Kernel UAFs are defensibly scored as high confidentiality impact because freed objects can be reused for information disclosure primitives.\nI:H - The same UAF/double-free condition can be leveraged through heap reuse and spraying to corrupt kernel objects or control flow. Under the required guidance, UAF memory corruption is High integrity impact.\nA:H - Even without full exploitation, the double sock_put/use-after-free can crash or destabilize the kernel. Kernel crashes and UAF-triggered oops/panic conditions are High availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/sco.c"], "versions": [{"version": "70a13b1e25fef37c87c8a1228ddb8900efbca7cf", "lessThan": "dabf22269242e2f2bf44c43fcdc2fa763df7f9cc", "status": "affected", "versionType": "git"}, {"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0", "status": "affected", "versionType": "git"}, {"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "7e296ffdab5bdab718dff7c14288fdcb9154fa27", "status": "affected", "versionType": "git"}, {"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d", "status": "affected", "versionType": "git"}, {"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "d002bd11024bd231bcb606877e33951ffb7bed14", "status": "affected", "versionType": "git"}, {"version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "8a5b0135d4a5d9683203a3d9a12a711ccec5936b", "status": "affected", "versionType": "git"}, {"version": "6.1.109", "lessThan": "6.1.168", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/sco.c"], "versions": [{"version": "6.3", "status": "affected"}, {"version": "0", "lessThan": "6.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.134", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.81", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.22", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.12", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.109", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.6.134"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.12.81"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.18.22"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "6.19.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.3", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc"}, {"url": "https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0"}, {"url": "https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27"}, {"url": "https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d"}, {"url": "https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14"}, {"url": "https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"}], "title": "Bluetooth: SCO: fix race conditions in sco_sock_connect()", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:13:36.010372Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:09.917Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43023", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:13:36.010372Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:13:36.581Z"}}], "cna": {"title": "Bluetooth: SCO: fix race conditions in sco_sock_connect()", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the local connect() syscall on an AF_BLUETOOTH/SCO socket. A Bluetooth peer or HCI disconnect can influence timing, but an adjacent attacker alone cannot race two connect() calls on the same local socket.\nAC:L - The attacker can create the race by issuing concurrent connect() syscalls on the same socket and repeating attempts while the normal HCI failure/disconnect path runs. Under the higher-severity rule, this attacker-controlled race is Low complexity.\nPR:L - SCO socket creation and connect do not impose a capability check, though AF_BLUETOOTH is limited to init_net rather than unprivileged network namespaces. A basic unprivileged local user on the host can open and race BTPROTO_SCO sockets.\nUI:N - No victim action is required once the attacker can run local code. The attacker directly invokes socket/connect operations and can repeat the race.\nS:U - The bug corrupts kernel Bluetooth socket/connection state within the same kernel security authority. It is a standard local kernel compromise/DoS path, not a VM escape or cross-scope boundary bypass.\nC:H - The race leads to a use-after-free/double sock_put on kernel socket objects. Kernel UAFs are defensibly scored as high confidentiality impact because freed objects can be reused for information disclosure primitives.\nI:H - The same UAF/double-free condition can be leveraged through heap reuse and spraying to corrupt kernel objects or control flow. Under the required guidance, UAF memory corruption is High integrity impact.\nA:H - Even without full exploitation, the double sock_put/use-after-free can crash or destabilize the kernel. Kernel crashes and UAF-triggered oops/panic conditions are High availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "70a13b1e25fef37c87c8a1228ddb8900efbca7cf", "lessThan": "dabf22269242e2f2bf44c43fcdc2fa763df7f9cc", "versionType": "git"}, {"status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0", "versionType": "git"}, {"status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "7e296ffdab5bdab718dff7c14288fdcb9154fa27", "versionType": "git"}, {"status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d", "versionType": "git"}, {"status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "d002bd11024bd231bcb606877e33951ffb7bed14", "versionType": "git"}, {"status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "lessThan": "8a5b0135d4a5d9683203a3d9a12a711ccec5936b", "versionType": "git"}, {"status": "affected", "version": "6.1.109", "lessThan": "6.1.168", "versionType": "semver"}], "programFiles": ["net/bluetooth/sco.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"status": "unaffected", "version": "0", "lessThan": "6.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.134", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.81", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.22", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.12", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/sco.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc"}, {"url": "https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0"}, {"url": "https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27"}, {"url": "https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d"}, {"url": "https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14"}, {"url": "https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n Thread A (connect): HCI disconnect: Thread B (connect):\n\n sco_sock_connect(sk) sco_sock_connect(sk)\n sk_state==BT_OPEN sk_state==BT_OPEN\n (pass, no lock) (pass, no lock)\n sco_connect(sk): sco_connect(sk):\n hci_dev_lock hci_dev_lock\n hci_connect_sco <- blocked\n -> hcon1\n sco_conn_add->conn1\n lock_sock(sk)\n sco_chan_add:\n conn1->sk = sk\n sk->conn = conn1\n sk_state=BT_CONNECT\n release_sock\n hci_dev_unlock\n hci_dev_lock\n sco_conn_del:\n lock_sock(sk)\n sco_chan_del:\n sk->conn=NULL\n conn1->sk=NULL\n sk_state=\n BT_CLOSED\n SOCK_ZAPPED\n release_sock\n hci_dev_unlock\n (unblocked)\n hci_connect_sco\n -> hcon2\n sco_conn_add\n -> conn2\n lock_sock(sk)\n sco_chan_add:\n sk->conn=conn2\n sk_state=\n BT_CONNECT\n // zombie sk!\n release_sock\n hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n HCI connection leaks"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "6.1.109"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:25:19.630Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43023", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:06:09.917Z", "dateReserved": "2026-05-01T14:12:55.975Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-01T14:15:25.736Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dabf22269242e2f2bf44c43fcdc2fa763df7f9cc", "status": "affected", "version": "70a13b1e25fef37c87c8a1228ddb8900efbca7cf", "versionType": "git"}, {"lessThan": "adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0", "status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "versionType": "git"}, {"lessThan": "7e296ffdab5bdab718dff7c14288fdcb9154fa27", "status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "versionType": "git"}, {"lessThan": "98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d", "status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "versionType": "git"}, {"lessThan": "d002bd11024bd231bcb606877e33951ffb7bed14", "status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "versionType": "git"}, {"lessThan": "8a5b0135d4a5d9683203a3d9a12a711ccec5936b", "status": "affected", "version": "9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3", "versionType": "git"}, {"lessThan": "6.1.168", "status": "affected", "version": "6.1.109", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.3"}, {"lessThan": "6.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.134", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.81", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.22", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4F30D66-D58E-49A0-B69A-36EEB7033DDE", "versionEndExcluding": "6.1.168", "versionStartIncluding": "6.1.109", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8DCEDE49-945B-4AC9-8166-D0841A4A8257", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.3.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "6EF80433-B33B-43C5-8E64-0FA7B8DCE1BC", "versionEndExcluding": "6.12.81", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C9DF8BCE-36D3-475D-9D21-19E4F02F9029", "versionEndExcluding": "6.18.22", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A2B9540-02D5-41B4-B16A-82AF66FD4F36", "versionEndExcluding": "6.19.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:-:*:*:*:*:*:*", "matchCriteriaId": "21D6F467-B848-453E-B1A4-BEF940E413A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.3:rc7:*:*:*:*:*:*", "matchCriteriaId": "B1240A34-749A-49F5-B8DD-C09441AD2228", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: fix race conditions in sco_sock_connect()\n\nsco_sock_connect() checks sk_state and sk_type without holding\nthe socket lock. Two concurrent connect() syscalls on the same\nsocket can both pass the check and enter sco_connect(), leading\nto use-after-free.\n\nThe buggy scenario involves three participants and was confirmed\nwith additional logging instrumentation:\n\n Thread A (connect): HCI disconnect: Thread B (connect):\n\n sco_sock_connect(sk) sco_sock_connect(sk)\n sk_state==BT_OPEN sk_state==BT_OPEN\n (pass, no lock) (pass, no lock)\n sco_connect(sk): sco_connect(sk):\n hci_dev_lock hci_dev_lock\n hci_connect_sco <- blocked\n -> hcon1\n sco_conn_add->conn1\n lock_sock(sk)\n sco_chan_add:\n conn1->sk = sk\n sk->conn = conn1\n sk_state=BT_CONNECT\n release_sock\n hci_dev_unlock\n hci_dev_lock\n sco_conn_del:\n lock_sock(sk)\n sco_chan_del:\n sk->conn=NULL\n conn1->sk=NULL\n sk_state=\n BT_CLOSED\n SOCK_ZAPPED\n release_sock\n hci_dev_unlock\n (unblocked)\n hci_connect_sco\n -> hcon2\n sco_conn_add\n -> conn2\n lock_sock(sk)\n sco_chan_add:\n sk->conn=conn2\n sk_state=\n BT_CONNECT\n // zombie sk!\n release_sock\n hci_dev_unlock\n\nThread B revives a BT_CLOSED + SOCK_ZAPPED socket back to\nBT_CONNECT. Subsequent cleanup triggers double sock_put() and\nuse-after-free. Meanwhile conn1 is leaked as it was orphaned\nwhen sco_conn_del() cleared the association.\n\nFix this by:\n- Moving lock_sock() before the sk_state/sk_type checks in\n sco_sock_connect() to serialize concurrent connect attempts\n- Fixing the sk_type != SOCK_SEQPACKET check to actually\n return the error instead of just assigning it\n- Adding a state re-check in sco_connect() after lock_sock()\n to catch state changes during the window between the locks\n- Adding sco_pi(sk)->conn check in sco_chan_add() to prevent\n double-attach of a socket to multiple connections\n- Adding hci_conn_drop() on sco_chan_add failure to prevent\n HCI connection leaks"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: SCO: corregir condiciones de carrera en sco_sock_connect()\n\nsco_sock_connect() comprueba sk_state y sk_type sin mantener el bloqueo del socket. Dos llamadas al sistema connect() concurrentes en el mismo socket pueden ambas pasar la comprobaci\u00f3n y entrar en sco_connect(), lo que lleva a uso despu\u00e9s de liberaci\u00f3n.\n\nEl escenario con errores involucra a tres participantes y fue confirmado con instrumentaci\u00f3n de registro adicional:\n\n Hilo A (conexi\u00f3n): Desconexi\u00f3n HCI: Hilo B (conexi\u00f3n):\n\n sco_sock_connect(sk) sco_sock_connect(sk)\n sk_state==BT_OPEN sk_state==BT_OPEN\n (pasa, sin bloqueo) (pasa, sin bloqueo)\n sco_connect(sk): sco_connect(sk):\n hci_dev_lock hci_dev_lock\n hci_connect_sco <- bloqueado\n -> hcon1\n sco_conn_add -> conn1\n lock_sock(sk)\n sco_chan_add:\n conn1 -> sk = sk\n sk -> conn = conn1\n sk_state=BT_CONNECT\n release_sock\n hci_dev_unlock\n hci_dev_lock\n sco_conn_del:\n lock_sock(sk)\n sco_chan_del:\n sk -> conn=NULL\n conn1 -> sk=NULL\n sk_state=\n BT_CLOSED\n SOCK_ZAPPED\n release_sock\n hci_dev_unlock\n (desbloqueado)\n hci_connect_sco\n -> hcon2\n sco_conn_add\n -> conn2\n lock_sock(sk)\n sco_chan_add:\n sk -> conn=conn2\n sk_state=\n BT_CONNECT\n // \u00a1sk zombi!\n release_sock\n hci_dev_unlock\n\nEl Hilo B revive un socket BT_CLOSED + SOCK_ZAPPED de nuevo a BT_CONNECT. La limpieza posterior dispara un doble sock_put() y uso despu\u00e9s de liberaci\u00f3n. Mientras tanto, conn1 se filtra ya que qued\u00f3 hu\u00e9rfano cuando sco_conn_del() elimin\u00f3 la asociaci\u00f3n.\n\nEsto se soluciona mediante:\n- Mover lock_sock() antes de las comprobaciones de sk_state/sk_type en sco_sock_connect() para serializar los intentos de conexi\u00f3n concurrentes\n- Corregir la comprobaci\u00f3n sk_type != SOCK_SEQPACKET para que realmente devuelva el error en lugar de solo asignarlo\n- A\u00f1adir una nueva comprobaci\u00f3n de estado en sco_connect() despu\u00e9s de lock_sock() para detectar cambios de estado durante la ventana entre los bloqueos\n- A\u00f1adir una comprobaci\u00f3n sco_pi(sk) -> conn en sco_chan_add() para evitar la doble asociaci\u00f3n de un socket a m\u00faltiples conexiones\n- A\u00f1adir hci_conn_drop() en caso de fallo de sco_chan_add para evitar fugas de conexi\u00f3n HCI"}], "id": "CVE-2026-43023", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43023", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:13:36.010372Z", "version": "2.0.3"}}]}, "published": "2026-05-01T15:16:46.610", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: SCO: fix race conditions in sco_sock_connect()", "id": "2464496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464496"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-821", "details": ["A flaw was found in the Linux kernel, specifically within its Bluetooth Synchronous Connection-Oriented (SCO) component. This vulnerability occurs due to race conditions when multiple connection attempts are made simultaneously on the same Bluetooth socket. This can lead to a use-after-free error, where the system attempts to use memory that has already been released. Exploitation of this flaw could result in system instability, causing the system to crash or become unresponsive, and potentially lead to a denial of service."], "name": "CVE-2026-43023", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-01T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43023\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43023\nhttps://lore.kernel.org/linux-cve-announce/2026050158-CVE-2026-43023-19eb@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[70a13b1e25fef37c87c8a1228ddb8900efbca7cf,dabf22269242e2f2bf44c43fcdc2fa763df7f9cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3,adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3,7e296ffdab5bdab718dff7c14288fdcb9154fa27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3,98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3,d002bd11024bd231bcb606877e33951ffb7bed14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9a8ec9e8ebb5a7c0cfbce2d6b4a6b67b2b78e8f3,8a5b0135d4a5d9683203a3d9a12a711ccec5936b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.3"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.3)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.168,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.134,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.81,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.22,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.12,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-01T18:45:15.324138+00:00", "updated": "2026-05-08T19:45:15.214806+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}