CVE-2026-80666

A flaw was found in the Linux kernel's Bluetooth Synchronous Connection-Oriented (SCO) component. A race condition exists in the sco_sock_timeout() function. When a Bluetooth SCO socket is closing while its timer is active, the system attempts to acquire the same lock twice, leading to a deadlock. This can result in a Denial of Service (DoS) for the affected system.

Red Hat has rated the impact of this flaw as Low for Red Hat Enterprise Linux and Red Hat In-Vehicle OS. A race condition was found in the Linux kernel's Bluetooth Synchronous Connection-Oriented (SCO) subsystem. The sco_sock_timeout() function runs asynchronously and takes the socket lock; if a Bluetooth SCO socket is being closed while that timeout work is active, the close path holds the socket lock and waits for the timeout work to finish while the timeout work itself tries to acquire the same socket lock, resulting in a deadlock. A local user able to open and close Bluetooth SCO sockets could trigger this race to cause a kernel deadlock, resulting in a denial of service of the affected system. The flaw has no confidentiality or integrity impact, and reliably winning the race requires precise timing, which is reflected in the Low impact rating despite the moderate Red Hat CVSS:3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The vulnerable code was introduced by the kref-based sco_conn lifetime tracking backport, so Red Hat Enterprise Linux 6, 7, and 8 and the RHEL 9.2, 9.4, and 9.6 update streams, which do not contain that code, are not affected. For the affected Red Hat Enterprise Linux 9, 10, and Red Hat In-Vehicle OS kernel streams, the fix is deferred because of the low impact of the flaw; the residual risk is limited to a local denial of service with no confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.