In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade python3-perf | Aug 13, 2025 | Aug 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-azure-4.15Upgrade linux-awsUpgrade linux-realtimeUpgrade linux-gcp-4.15Upgrade linux-gcpUpgrade linux-bluefieldUpgrade linux-lowlatency-hwe-5.15Upgrade linux-fipsUpgrade linux-raspi-5.4Upgrade linux-kvmUpgrade linux-gcp-fipsUpgrade linux-intel-iotgUpgrade linux-azure-5.4Upgrade linux-hweUpgrade linux-gcp-5.4Upgrade linux-gcp-5.15Upgrade linux-hwe-5.4Upgrade linux-riscv-5.15Upgrade linux-gkeopUpgrade linux-oracle-5.15Upgrade linux-oracleUpgrade linux-azureUpgrade linux-azure-fipsUpgrade linux-iotUpgrade linux-raspiUpgrade linux-azure-5.15Upgrade linux-hwe-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-nvidiaUpgrade linux-oracle-5.4Upgrade linux-aws-hweUpgrade linux-ibmUpgrade linux-gkeUpgrade linuxUpgrade linux-ibm-5.4Upgrade linux-aws-5.4Upgrade linux-lowlatencyUpgrade linux-aws-5.15Upgrade linux-aws-fips | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub