CVE-2026-89774— Linux内核蓝牙SCO连接准备函数缺陷
一分钟漏洞结论
影响对象
Linux Linux
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-89774 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Bluetooth: SCO: hold sk properly in sco_conn_ready
来源: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SCO: hold sk properly in sco_conn_ready
sk deref in sco_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk and parent sk is
currently accessed without either, and without checking parent->sk_state:
[Task 1] [Task 2]
sco_sock_release
sco_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
sco_sock_kill(sk)
UAF on sk deref
and similarly for access to sco_get_sock_listen() return value.
Fix possible UAF by holding sk refcount in sco_conn_ready() and making
sco_get_sock_listen() increase refcount. Also recheck after lock_sock
that the socket is still valid. Adjust conn->sk locking so it's
protected also by lock_sock() of the associated socket if any.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
N/A
来源: CVE Program / CVE List V5
受影响产品
二、漏洞 CVE-2026-89774 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-89774 的情报信息
请登录查看更多情报信息。
CVE-2026-89774 其他参考 (6)
同批安全公告 · Linux · 2026-09-16 · 共 19 条
| CVE-2026-89784 | SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 | |
| CVE-2026-89775 | KVM arm64 VNCR TLB大小计算漏洞 | |
| CVE-2026-89776 | Linux内核VXLAN vnifilter属性长度校验漏洞 | |
| CVE-2026-89778 | isofs: fix out-of-bounds page array access on empty zisofs block | |
| CVE-2026-89777 | vfio/pci: clear vdev->msi_perm after freeing it on init failure | |
| CVE-2026-89779 | fs/ntfs3: validate ef->size covers the record's name and value | |
| CVE-2026-89781 | fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() | |
| CVE-2026-89780 | net: qualcomm: rmnet: restore skb->dev on deaggregated frames | |
| CVE-2026-89782 | fs/ntfs3: reject restart table growth beyond U16_MAX entries | |
| CVE-2026-89792 | Linux ksmbd共享配置越界读取 | |
| CVE-2026-89783 | xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full | |
| CVE-2026-89785 | fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init | |
| CVE-2026-89787 | ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() | |
| CVE-2026-89786 | ext4: fix out-of-bounds read in ext4_read_inline_dir() | |
| CVE-2026-89788 | ksmbd: fix tree connection use-after-free in smb2_tree_connect() | |
| CVE-2026-89790 | Linux内核IPv6路由零除漏洞 | |
| CVE-2026-89789 | Linux内核GTP模块释放后使用漏洞 | |
| CVE-2026-89791 | perf: Fix use-after-free when perf mmap() revival races with the last munmap() |
IV. Related Vulnerabilities
V. Comments for CVE-2026-89774
暂无评论