CVE-2026-31408 - Vulnerability Details

- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately
releases the lock without holding a reference to the socket. A concurrent
close() can free the socket between the lock release and the subsequent
sk->sk_state access, resulting in a use-after-free.

Other functions in the same file (sco_sock_timeout(), sco_conn_del())
correctly use sco_sock_hold() to safely hold a reference under the lock.

Fix by using sco_sock_hold() to take a reference before releasing the
lock, and adding sock_put() on all exit paths.

Published: 2026-04-06

Score: 8.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A concurrent close operation can free the socket after the lock in sco_recv_frame() is released but before the socket state is accessed, causing a use-after-free. This memory corruption may lead to kernel crashes or permit an attacker to execute arbitrary kernel code, potentially escalating privileges. The vulnerability resides in the Bluetooth SCO subsystem and requires a malicious or malformed SCO frame transmitted during a connection.

Affected Systems

All Linux kernel implementations that contain the vulnerable sco_recv_frame() routine. No specific kernel versions are listed in the CNA data, so any kernel prior to the patch containing this fix is susceptible.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, while an EPSS score of less than 1% suggests low likelihood of exploitation. The vulnerability is not in the CISA KEV catalog. Based on the description, the likely attack vector is a Bluetooth device that initiates or sends SCO frames; an attacker must be able to connect or interfere with a target’s Bluetooth stack to trigger the use-after-free.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< d57384e27d1ebf0047e3f00a6e1181b8be9857a2
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b0a7da0e3f7442545f071499beb36374714bb9de
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 45aaca995e4a7a05b272a58e7ab2fff4f611b8f1
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 108b81514d8f2535eb16651495cefb2250528db3
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e76e8f0581ef555eacc11dbb095e602fb30a5361
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 598dbba9919c5e36c54fe1709b557d64120cb94b

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,45aaca995e4a7a05b272a58e7ab2fff4f611b8f1)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,108b81514d8f2535eb16651495cefb2250528db3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e76e8f0581ef555eacc11dbb095e602fb30a5361)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,598dbba9919c5e36c54fe1709b557d64120cb94b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.6.131,7.0.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0-rc6,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that incorporates the sco_recv_frame fix.
Reboot the system to activate the updated kernel.
If immediate patching is not feasible, restrict Bluetooth services or disable the SCO profile until a security update is applied.

Generated by OpenCVE AI on April 28, 2026 at 08:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/108b81514d8f2535eb16651495cefb2250528db3
https://git.kernel.org/stable/c/45aaca995e4a7a05b272a58e7ab2fff4f611b8f1
https://git.kernel.org/stable/c/598dbba9919c5e36c54fe1709b557d64120cb94b
https://git.kernel.org/stable/c/7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e
https://git.kernel.org/stable/c/b0a7da0e3f7442545f071499beb36374714bb9de
https://git.kernel.org/stable/c/d57384e27d1ebf0047e3f00a6e1181b8be9857a2
https://git.kernel.org/stable/c/e76e8f0581ef555eacc11dbb095e602fb30a5361
https://lore.kernel.org/linux-cve-announce/2026040629-CVE-2026-31408-9f0f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31408
https://www.cve.org/CVERecord?id=CVE-2026-31408

History

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/d57384e27d1ebf0047e3f00a6e1181b8be9857a2

Sat, 11 Apr 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b0a7da0e3f7442545f071499beb36374714bb9de

Tue, 07 Apr 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 07 Apr 2026 00:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026040629-CVE-2026-31408-9f0f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31408 https://www.cve.org/CVERecord?id=CVE-2026-31408
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 06 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.
Title		Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/108b81514d8f2535eb16651495cefb2250528db3 https://git.kernel.org/stable/c/45aaca995e4a7a05b272a58e7ab2fff4f611b8f1 https://git.kernel.org/stable/c/598dbba9919c5e36c54fe1709b557d64120cb94b https://git.kernel.org/stable/c/7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e https://git.kernel.org/stable/c/e76e8f0581ef555eacc11dbb095e602fb30a5361

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-06T07:38:20.533Z

Updated: 2026-04-27T14:02:55.823Z

Reserved: 2026-03-09T15:48:24.086Z

Link: CVE-2026-31408

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-04-06T08:16:38.757

Modified: 2026-04-27T14:16:36.977

Link: CVE-2026-31408

Redhat

Severity : Moderate

Publid Date: 2026-04-06T00:00:00Z

Links: CVE-2026-31408 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-28T09:00:06Z

Weaknesses

CWE-911

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object