https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:03:28 +0000 https://vulnerability.circl.lu/vuln/cve-2026-31408 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold</p> <p>sco_recv_frame() reads conn-&gt;sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk-&gt;sk_state access, resulting in a use-after-free.</p> <p>Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock.</p> <p>Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold</p> <p>sco_recv_frame() reads conn-&gt;sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk-&gt;sk_state access, resulting in a use-after-free.</p> <p>Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock.</p> <p>Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.</p> https://vulnerability.circl.lu/vuln/cve-2026-31408