CVE-2026-31408

A flaw was found in the Linux kernel's Bluetooth SCO (Synchronous Connection-Oriented) protocol implementation. The sco_recv_frame() function fails to properly hold a reference to a socket after releasing a lock. This oversight allows a concurrent operation to free the socket while it is still being accessed, leading to a use-after-free vulnerability. A local attacker could potentially exploit this to cause memory corruption or a denial of service.

Under sco_conn_lock, the code read conn->sk then dropped the lock without sco_sock_hold(), so close() could race and free the socket before sk->sk_state use. The fix mirrors other SCO helpers. Adjacent Bluetooth is involved; impact is UAF and likely crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.