CVE-2026-80683: Software Security Vulnerability Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-pwm9-r6v6-m8hc",
  "modified" : "2026-08-29T09:30:28Z",
  "published" : "2026-08-28T09:31:49Z",
  "aliases" : [ "CVE-2026-80683" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: give the socket its own sco_conn reference\n\nsco_conn_del() drops a reference it does not own. It takes one transient\nreference via sco_conn_hold_unless_zero() and releases it with the\nsco_conn_put() that follows sco_sock_hold(); the additional put in the\n!sk branch releases a second one:\n\n    conn = sco_conn_hold_unless_zero(conn);\n    ...\n    sk = sco_sock_hold(conn);\n    sco_conn_unlock(conn);\n    sco_conn_put(conn);\n\n    if (!sk) {\n            sco_conn_put(conn);\n            return;\n    }\n\nWhen close() races the controller's Disconnection Complete, sco_chan_del()\nclears conn->sk and drops the socket's reference while sco_conn_del() is\nrunning. sco_conn_del() then sees sk == NULL, its own put drops the count\nto zero and frees the conn, and the second put writes to the freed kref:\n\n    BUG: KASAN: slab-use-after-free in sco_conn_put.part.0+0x1a/0x190\n    Write of size 4 at addr ffff8881099dec74 by task kworker/u17:3/413\n    Workqueue: hci1 hci_rx_work\n    Call Trace:\n     sco_conn_put.part.0+0x1a/0x190\n     hci_disconn_complete_evt+0x1ee/0x3e0\n     hci_event_packet+0x54a/0x650\n     hci_rx_work+0x321/0x3d0\n    Allocated by task 413:\n     sco_conn_add+0x72/0x1a0\n     sco_connect_cfm+0x88/0x670\n    Freed by task 413:\n     sco_conn_del.isra.0+0x3f/0xf0\n     hci_disconn_complete_evt+0x1ee/0x3e0\n    refcount_t: underflow; use-after-free.\n\nThe root cause is that the socket stores the connection without holding a\nreference of its own. __sco_chan_add() does:\n\n    sco_pi(sk)->conn = conn;\n\nso the socket borrows whatever reference its caller happened to hold, and\nthe callers paper over that with ad-hoc holds and puts. Give the socket a\ncounted reference instead: __sco_chan_add() takes one and it is released\ntogether with the channel (sco_chan_del()) and in sco_sock_destruct().\nWith the socket holding its own reference, sco_conn_del() no longer needs\nthe extra put and the redundant hold in sco_conn_ready() goes away.\n\nMaking the socket own its reference means the connection is now actually\nfreed on the error paths of sco_connect() where it used to leak, which in\nturn runs sco_conn_free() and its hci_conn_drop(conn->hcon). To keep the\nhci_conn accounting balanced, make that ownership explicit as well:\nsco_conn_add() consumes one hci_conn reference and the sco_conn owns it for\nits lifetime. sco_connect() hands over the reference returned by\nhci_connect_sco() and no longer drops it on the error paths;\nsco_connect_cfm(), which is not given a reference, takes one with\nhci_conn_hold() before handing it to sco_conn_add() (and drops it again if\nthe allocation fails); and the explicit hci_conn_hold() in sco_conn_ready()\nis removed. Every reference then has a single, clear owner.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-80683"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8fe627192fa5da7157f9a48608f13c04b6373e43"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/a33bc07b4730b6cd5681ac77d18ae0de3e739690"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/abd93c85c8667add738ee82aeab95dd9fc8265a2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-08-28T08:16:53Z"
  }
}