In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout
Connecting the same socket twice consecutively in sco_sock_connect() could lead to a race condition where two sco_conn objects are created but only one is associated with the socket. If the socket is closed before the SCO connection is established, the timer associated with the dangling sco_conn object won't be canceled. As the sock object is being freed, the use-after-free problem happens when the timer callback function sco_sock_timeout() accesses the socket. Here's the call trace:
dump_stack+0x107/0x163 ? refcount_inc+0x1c/ print_address_description.constprop.0+0x1c/0x47e ? refcount_inc+0x1c/0x7b kasan_report+0x13a/0x173 ? refcount_inc+0x1c/0x7b check_memory_region+0x132/0x139 refcount_inc+0x1c/0x7b sco_sock_timeout+0xb2/0x1ba process_one_work+0x739/0xbd1 ? cancel_delayed_work+0x13f/0x13f ? __raw_spin_lock_init+0xf0/0xf0 ? to_kthread+0x59/0x85 worker_thread+0x593/0x70e kthread+0x346/0x35a ? drain_workqueue+0x31a/0x31a ? kthread_bind+0x4b/0x4b ret_from_fork+0x1f/0x30
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Feb 27, 2025 | Feb 27, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernelUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-tools-libs | Aug 13, 2025 | Aug 9, 2025 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2025 |
| Ubuntu | — | Upgrade linux-intel-iotg-5.15Upgrade linux-nvidiaUpgrade linux-hwe-5.15Upgrade linux-aws-5.4Upgrade linux-azure-fipsUpgrade linux-azure-5.15Upgrade linux-oracle-5.15Upgrade linux-aws-5.15Upgrade linux-iotUpgrade linux-aws-fipsUpgrade linux-raspiUpgrade linux-gkeopUpgrade linux-ibmUpgrade linux-oracle-5.4Upgrade linux-azureUpgrade linux-aws-hweUpgrade linux-oracleUpgrade linux-ibm-5.4Upgrade linux-lowlatencyUpgrade linux-gkeUpgrade linuxUpgrade linux-azure-5.4Upgrade linux-lowlatency-hwe-5.15Upgrade linux-hwe-5.4Upgrade linux-awsUpgrade linux-hweUpgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-riscv-5.15Upgrade linux-gcp-4.15Upgrade linux-gcp-fipsUpgrade linux-kvmUpgrade linux-raspi-5.4Upgrade linux-gcp-5.4Upgrade linux-realtimeUpgrade linux-gcp-5.15Upgrade linux-azure-4.15Upgrade linux-fipsUpgrade linux-intel-iotg | Mar 3, 2025 | Feb 26, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Feb 26, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub