CVE-2026-89774— Bluetooth: SCO: hold sk properly in sco_conn_ready
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: hold sk properly in sco_conn_ready sk deref in sco_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk and parent sk is
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-89774
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Bluetooth: SCO: hold sk properly in sco_conn_ready
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
Bluetooth: SCO: hold sk properly in sco_conn_ready
sk deref in sco_conn_ready must be done either under conn->lock, or
holding a refcount, to avoid concurrent close. conn->sk and parent sk is
currently accessed without either, and without checking parent->sk_state:
[Task 1] [Task 2]
sco_sock_release
sco_conn_ready
sk = conn->sk
lock_sock(sk)
conn->sk = NULL
lock_sock(sk)
release_sock(sk)
sco_sock_kill(sk)
UAF on sk deref
and similarly for access to sco_get_sock_listen() return value.
Fix possible UAF by holding sk refcount in sco_conn_ready() and making
sco_get_sock_listen() increase refcount. Also recheck after lock_sock
that the socket is still valid. Adjust conn->sk locking so it's
protected also by lock_sock() of the associated socket if any.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-89774
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-89774
请登录查看更多情报信息。
Other References for CVE-2026-89774 (6)
Same Patch Batch · Linux · 2026-09-16 · 20 CVEs total
| CVE-2026-89783 | xfrm6: fix out-of-bounds write in xfrm6_input_addr() when secpath is full | |
| CVE-2026-89775 | KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation | |
| CVE-2026-89776 | vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes | |
| CVE-2026-89778 | isofs: fix out-of-bounds page array access on empty zisofs block | |
| CVE-2026-89777 | vfio/pci: clear vdev->msi_perm after freeing it on init failure | |
| CVE-2026-89779 | fs/ntfs3: validate ef->size covers the record's name and value | |
| CVE-2026-89781 | fs/ntfs3: fix out-of-bounds read in read_log_rec_buf() | |
| CVE-2026-89780 | net: qualcomm: rmnet: restore skb->dev on deaggregated frames | |
| CVE-2026-89782 | fs/ntfs3: reject restart table growth beyond U16_MAX entries | |
| CVE-2026-89784 | SUNRPC: check rpc_sockaddr2uaddr() return value in rpcb_register_inet4/6 | |
| CVE-2026-89793 | ublk: clear VM_MAYWRITE on read-only ublk char device mmap | |
| CVE-2026-89785 | fs/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse/objid init | |
| CVE-2026-89787 | ext4: check dir entry fits before reading the hash trailer in ext4_search_dir() | |
| CVE-2026-89786 | ext4: fix out-of-bounds read in ext4_read_inline_dir() | |
| CVE-2026-89788 | ksmbd: fix tree connection use-after-free in smb2_tree_connect() | |
| CVE-2026-89790 | ipv6: avoid divide by zero in rt6_multipath_rebalance | |
| CVE-2026-89789 | gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free | |
| CVE-2026-89791 | perf: Fix use-after-free when perf mmap() revival races with the last munmap() | |
| CVE-2026-89792 | ksmbd: prevent out-of-bounds reads in share config responses |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-89793
ublk: clear VM_MAYWRITE on read-only ublk char device mmap -
CVE-2026-89792
ksmbd: prevent out-of-bounds reads in share config responses -
CVE-2026-89791
perf: Fix use-after-free when perf mmap() revival races with -
CVE-2026-89789
gtp: add synchronize_net() in gtp_newlink() error path to pr -
CVE-2026-89790
ipv6: avoid divide by zero in rt6_multipath_rebalance
Same vendor: Linux
-
CVE-2026-89793
ublk: clear VM_MAYWRITE on read-only ublk char device mmap -
CVE-2026-89792
ksmbd: prevent out-of-bounds reads in share config responses -
CVE-2026-89791
perf: Fix use-after-free when perf mmap() revival races with -
CVE-2026-89789
gtp: add synchronize_net() in gtp_newlink() error path to pr -
CVE-2026-89790
ipv6: avoid divide by zero in rt6_multipath_rebalance
V. Comments for CVE-2026-89774
No comments yet