CVE-2026-80666: Linux Kernel Bluetooth SCO Race Condition

CVE-2026-80666 Overview

CVE-2026-80666 is a race condition in the Linux kernel's Bluetooth Synchronous Connection-Oriented (SCO) socket implementation. The flaw exists in sco_sock_timeout(), which runs asynchronously and acquires lock_sock(sk). When a socket closes while its timer is still running, the same socket lock can be acquired twice, producing a deadlock. The issue was detected by the kernel lockdep subsystem and reported through Linux stable tree maintainers. Upstream commits fix the defect by moving disable_delayed_work_sync() outside the lock_sock(sk) critical section.

Critical Impact
A local attacker with the ability to open and close SCO sockets can trigger a kernel deadlock, causing a denial-of-service condition on the affected system.

Affected Products

Linux kernel Bluetooth subsystem (net/bluetooth/sco.c)
Kernel versions preceding the fixes in commits 0f8a5dc, a50da11, and da4d8ee
Distributions shipping vulnerable stable kernel builds

Discovery Timeline

2026-08-28 - CVE-2026-80666 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80666

Vulnerability Analysis

The defect is a classic ABBA-style deadlock in the Bluetooth SCO socket path. sco_sock_close() acquires lock_sock(sk) and then invokes __sco_sock_close(), which reaches sco_chan_del() and sco_conn_put(). When the reference count drops to zero, sco_conn_free() calls disable_delayed_work_sync() to cancel the pending timeout work. That call flushes sco_sock_timeout(), which itself attempts to acquire lock_sock(sk) on the same socket. Both paths hold or wait on the same sk_lock-AF_BLUETOOTH-BTPROTO_SCO, producing the deadlock captured by lockdep.

This is a race condition [CWE-667] between socket teardown and the asynchronous timeout worker. Successful triggering hangs the kernel worker thread and any subsequent operations depending on the SCO socket lock, resulting in denial of service.

Root Cause

The root cause is improper lock ordering during connection cleanup. disable_delayed_work_sync() was invoked from sco_conn_free() while the caller still held the socket lock. Because sco_sock_timeout() itself must acquire the same lock, synchronously waiting on the worker from inside the lock guarantees deadlock whenever the worker is running.

Attack Vector

Exploitation requires local access with permission to create Bluetooth SCO sockets. An attacker races socket close operations against the SCO timeout worker to force the deadlock. The vulnerability does not provide code execution or privilege escalation, but it renders the Bluetooth subsystem and any worker-thread-dependent operations unresponsive.

The fix, applied in kernel commits 0f8a5dc, a50da11, and da4d8ee, moves disable_delayed_work_sync() outside the lock_sock(sk) region so no socket lock is held when the timeout worker is flushed.

Detection Methods for CVE-2026-80666

Indicators of Compromise

Kernel log entries containing possible circular locking dependency detected referencing sk_lock-AF_BLUETOOTH-BTPROTO_SCO and conn->timeout_work.
Hung task warnings tied to sco_sock_close, sco_conn_put, or disable_delayed_work_sync in net/bluetooth/sco.c.
Workqueue threads stalled in __flush_work waiting on SCO timeout work items.

Detection Strategies

Enable CONFIG_PROVE_LOCKING and CONFIG_LOCKDEP on test kernels to surface the circular dependency before deployment.
Compare running kernel versions against the fixed stable commits and flag hosts still on vulnerable builds.
Monitor dmesg and syslog forwarders for INFO: task ... blocked for more than messages naming SCO functions.

Monitoring Recommendations

Forward kernel ring buffer messages to a centralized log platform and alert on Bluetooth deadlock signatures.
Track Bluetooth service availability and worker thread health on endpoints that expose Bluetooth to untrusted users.
Audit local process activity that repeatedly opens and closes AF_BLUETOOTH sockets with BTPROTO_SCO.

How to Mitigate CVE-2026-80666

Immediate Actions Required

Apply the stable kernel updates that include commits 0f8a5dc, a50da11, and da4d8ee from the Linux stable tree.
Prioritize patching on multi-user Linux hosts and any system where local users can reach the Bluetooth stack.
Reboot affected hosts after upgrading to load the corrected kernel image.

Patch Information

The fix is available in the Linux stable tree via Kernel Git Commit 0f8a5dc, Kernel Git Commit a50da11, and Kernel Git Commit da4d8ee. The patch relocates disable_delayed_work_sync() in sco_conn_free() so it executes without holding lock_sock(sk), eliminating the recursive lock acquisition.

Workarounds

Disable the Bluetooth kernel modules where the feature is not required by blacklisting bluetooth and btusb in /etc/modprobe.d/.
Stop and mask the bluetooth.service unit on systems that do not need SCO audio functionality.
Restrict local access on shared systems until the fixed kernel is deployed.

bash

# Blacklist Bluetooth modules until kernel is patched
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl disable --now bluetooth.service
sudo update-initramfs -u