CVE-2026-80683

A flaw was found in the Linux kernel's Bluetooth SCO (Synchronous Connection-Oriented) protocol implementation. A local attacker or a nearby malicious Bluetooth device could trigger a race condition during the disconnection process, specifically when the sco_conn_del() function attempts to release a connection reference it does not own. This can lead to a use-after-free vulnerability, resulting in memory corruption and a system crash (Denial of Service).

Red Hat has evaluated this vulnerability as Moderate because exploitation requires local privileges or physical proximity to a device with active Bluetooth hardware, alongside specific timing conditions to win the teardown race. Standard Red Hat Enterprise Linux server environments typically operate without Bluetooth controllers enabled, significantly constraining the attack surface. Although a successful exploit of the reference counting flaw can trigger a kernel use-after-free and cause a system crash, it does not provide an unauthenticated remote vector over standard network interfaces.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.