LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31408: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately releases the lock without holding a reference to the socket. A concurrent close() can free the socket between the lock release and the subsequent sk->sk_state access, resulting in a use-after-free. Other functions in the same file (sco_sock_timeout(), sco_conn_del()) correctly use sco_sock_hold() to safely hold a reference under the lock. Fix by using sco_sock_hold() to take a reference before releasing the lock, and adding sock_put() on all exit paths.

HighCVSS 8.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux Bluetooth audio socket can be freed while the kernel is still using it. The supplied CVSS assessment indicates that an adjacent attacker could trigger this without privileges or user interaction, potentially affecting system confidentiality, integrity, and availability. Practical exploitability is not established by the supplied evidence.

Executive priority

Prioritize remediation for Bluetooth-capable laptops, mobile devices, embedded systems, kiosks, and edge equipment accessible to nearby untrusted parties. Patch promptly through supported vendor channels. Internet-facing status alone does not determine exposure because the CVSS attack vector is adjacent rather than remote network.

Technical view

A race in sco_recv_frame() releases sco_conn_lock() after reading conn->sk without retaining a socket reference. A concurrent close() can free that socket before sk->sk_state is accessed, causing a kernel use-after-free. Stable fixes retain the socket with sco_sock_hold() and release it using sock_put() on every exit path.

Likely exposure

Exposure is greatest on affected Linux systems where Bluetooth SCO audio functionality is available and reachable by nearby, untrusted devices. Systems without Bluetooth capability or SCO use are likely less exposed. The supplied affected-version data is ambiguous, so distribution-specific backport status must be verified rather than inferred solely from version numbers.

Exploitation context

The CVSS 8.8 vector specifies adjacent-network access, low complexity, no privileges, and no user interaction. However, the bundle marks KEV false and provides no evidence of active exploitation, public proof-of-concept code, or demonstrated real-world compromise. Treat exploitation status as unconfirmed.

Researcher notes

The vulnerable lifetime transition occurs between releasing sco_conn_lock() and accessing sk->sk_state. The patch pattern matches nearby functions that already retain socket references safely. Eight stable-kernel commits are supplied, apparently covering multiple maintained branches. No CWE, exploit demonstration, attack prerequisites beyond the CVSS vector, or reliable fixed-version mapping is provided.

Mitigation direction

  • Apply a vendor-supported kernel update containing the relevant stable fix or backport.
  • Check Linux distribution and device-vendor advisories for corrected package versions.
  • Prioritize Bluetooth-capable endpoints exposed to nearby untrusted devices.
  • Follow vendor guidance for temporary risk reduction if immediate patching is unavailable.

Validation and detection

  • Inventory running kernels on systems with Bluetooth hardware or enabled Bluetooth services.
  • Confirm each kernel package includes the applicable stable fix or vendor backport.
  • Identify whether Bluetooth SCO functionality is available or operationally required.
  • After updating, verify the corrected kernel is running, not merely installed.
  • Review kernel crash telemetry for Bluetooth or socket-related memory faults.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31408 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8.8CVSS 3.1HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H2.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

8.8High
CVSS 3.1 vector shape for CVE-2026-31408Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2unaffected
LinuxLinux2.6.12, 0, 5.10.265, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.