In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade kernelUpgrade bpftoolUpgrade python3-perfUpgrade kernel-tools | Aug 13, 2025 | Aug 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-raspi-5.4Upgrade linux-gcp-5.4Upgrade linux-azure-5.4Upgrade linux-kvmUpgrade linux-intel-iotgUpgrade linux-riscv-5.15Upgrade linux-awsUpgrade linux-gcp-4.15Upgrade linux-fipsUpgrade linux-hwe-5.4Upgrade linux-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-bluefieldUpgrade linux-gcp-5.15Upgrade linux-hweUpgrade linux-gcpUpgrade linux-gcp-fipsUpgrade linux-azure-4.15Upgrade linux-hwe-5.15Upgrade linux-aws-5.15Upgrade linux-aws-5.4Upgrade linux-oracleUpgrade linux-azureUpgrade linuxUpgrade linux-gkeopUpgrade linux-intel-iotg-5.15Upgrade linux-nvidiaUpgrade linux-oracle-5.15Upgrade linux-ibmUpgrade linux-lowlatencyUpgrade linux-gkeUpgrade linux-raspiUpgrade linux-ibm-5.4Upgrade linux-azure-fipsUpgrade linux-aws-fipsUpgrade linux-aws-hweUpgrade linux-iotUpgrade linux-azure-5.15Upgrade linux-oracle-5.4 | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub