CVE-2026-89774: Bluetooth: SCO: hold sk properly in sco_conn_ready

1. In CISA KEV: not seen
2. Exploited (reported): not seen
3. Scanning observed: not seen
4. Proof of concept public: not seen
5. Not establishedNothing in the sources we check

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is currently accessed without either, and without checking parent->sk_state: [Task 1] [Task 2] sco_sock_release sco_conn_ready sk = conn->sk lock_sock(sk) conn->sk = NULL lock_sock(sk) release_sock(sk) sco_sock_kill(sk) UAF on sk deref and similarly for access to sco_get_sock_listen() return value. Fix possible UAF by holding sk refcount in sco_conn_ready() and making sco_get_sock_listen() increase refcount. Also recheck after lock_sock that the socket is still valid. Adjust conn->sk locking so it's protected also by lock_sock() of the associated socket if any.

Exploitation

Unlikely (under 1%). EPSS under 1%, or no score yet.

CISA KEV

Not listed

Public check

No public nuclei template

Vendor

Linux

Published

September 2026

Band

Unlikely (under 1%), September 2026

• Red Hat Enterprise Linux 10Affected, no fix releasedchecked 15 Nov 02:00 UTC
• Red Hat Enterprise Linux 9Affected, no fix releasedchecked 15 Nov 02:00 UTC
• Red Hat Enterprise Linux 8Affected, no fix releasedchecked 15 Nov 02:00 UTC
• Ubuntu 26.04Fixedchecked 15 Nov 02:00 UTC
• Ubuntu 14.04Not affectedchecked 15 Nov 02:00 UTC
• Debian 13Fixed in linux 6.12.100-1checked 15 Nov 02:00 UTC
• Debian 12Fixed in linux 6.1.180-1checked 15 Nov 02:00 UTC
• SUSE Linux Enterprise Server 16.1Not affectedchecked 15 Nov 02:00 UTC
• SUSE Linux Enterprise Server 16.0Fixedchecked 15 Nov 02:00 UTC
• SUSE Linux Enterprise Server 15 SP7Fixedchecked 15 Nov 02:00 UTC
• openSUSE Leap 16.1Fixedchecked 15 Nov 02:00 UTC
• openSUSE Leap 16.0Fixedchecked 15 Nov 02:00 UTC

1. 15 Nov
   Seen in Debian’s tracker on 15 Nov: Debian 12 fixed in linux 6.1.180-1 Debian
2. 15 Nov
   Seen in Debian’s tracker on 15 Nov: Debian 13 fixed in linux 6.12.100-1 Debian
3. 15 Nov
   Red Hat’s tracker lists RHEL 10 as affected, with no fix released Red Hat
4. 15 Nov
   Red Hat’s tracker lists RHEL 7 as not affected Red Hat
5. 15 Nov
   Red Hat’s tracker lists RHEL 8 as affected, with no fix released Red Hat
6. 15 Nov
   Red Hat’s tracker lists RHEL 9 as affected, with no fix released Red Hat
7. 15 Nov
   Seen in SUSE’s tracker on 15 Nov: openSUSE Leap 16.0 fixed SUSE
8. 15 Nov
   Seen in SUSE’s tracker on 15 Nov: openSUSE Leap 16.1 fixed SUSE
9. 15 Nov
   SUSE’s tracker lists SLES 12 SP5 as affected, with no fix released SUSE
10. 15 Nov
    SUSE’s tracker lists SLES 15 SP1 as affected, with no fix released SUSE
11. 15 Nov
    SUSE’s tracker lists SLES 15 SP2 as affected, with no fix released SUSE
12. 15 Nov
    SUSE’s tracker lists SLES 15 SP3 as affected, with no fix released SUSE
13. 15 Nov
    SUSE’s tracker lists SLES 15 SP4 as affected, with no fix released SUSE
14. 15 Nov
    SUSE’s tracker lists SLES 15 SP5 as affected, with no fix released SUSE
15. 15 Nov
    SUSE’s tracker lists SLES 15 SP6 as affected, with no fix released SUSE
16. 15 Nov
    Seen in SUSE’s tracker on 15 Nov: SLES 15 SP7 fixed SUSE
17. 15 Nov
    Seen in SUSE’s tracker on 15 Nov: SLES 16.0 fixed SUSE
18. 15 Nov
    SUSE’s tracker lists SLES 16.1 as not affected SUSE
19. 15 Nov
    Ubuntu’s tracker lists Ubuntu 14.04 as not affected Ubuntu
20. 15 Nov
    Seen in Ubuntu’s tracker on 15 Nov: Ubuntu 26.04 fixed Ubuntu

Showing the latest 20 changes.

• NVD entrynvd.nist.gov
• Vendor advisorygit.kernel.org
• CVE recordcve.org