CVE-2026-80683: Linux Kernel Bluetooth SCO Use-After-Free

CVE-2026-80683 Overview

CVE-2026-80683 is a use-after-free vulnerability in the Linux kernel's Bluetooth Synchronous Connection-Oriented (SCO) socket implementation. The flaw resides in sco_conn_del(), which releases a sco_conn reference it does not own. When a socket close() races the controller's Disconnection Complete event, the reference counter underflows and the freed kref is written to, producing a KASAN slab-use-after-free warning in sco_conn_put. An attacker within Bluetooth range can trigger the race to corrupt kernel memory.

Critical Impact
Adjacent-network attackers can trigger a kernel-level use-after-free in the Bluetooth SCO stack, enabling potential memory corruption, denial of service, or privilege escalation on affected Linux systems.

Affected Products

Linux kernel Bluetooth SCO subsystem (net/bluetooth/sco.c)
Distributions shipping vulnerable Linux kernel versions prior to the fix commits
Systems with Bluetooth hardware enabled and SCO audio profiles in use

Discovery Timeline

2026-08-28 - CVE-2026-80683 published to NVD
2026-08-29 - Last updated in NVD database

Technical Details for CVE-2026-80683

Vulnerability Analysis

The vulnerability originates in the Bluetooth SCO socket reference-counting logic. __sco_chan_add() assigns sco_pi(sk)->conn = conn without taking a counted reference, so the socket borrows whatever reference its caller happened to hold. Callers compensate with ad-hoc hold/put pairs, and sco_conn_del() performs an extra sco_conn_put() in the !sk branch that releases a reference it never acquired.

When close() runs concurrently with the controller's Disconnection Complete event, sco_chan_del() clears conn->sk and drops the socket's reference while sco_conn_del() is still executing. sco_conn_del() then observes sk == NULL, its own put drops the count to zero and frees the conn, and the redundant put writes to the freed kref. KASAN reports a refcount_t: underflow; use-after-free. condition in sco_conn_put.part.0.

Root Cause

The root cause is missing ownership semantics for the sco_conn pointer stored on the socket. Because the socket did not hold its own counted reference, error paths in sco_connect() also leaked the connection, and reference balancing was scattered across multiple call sites.

Attack Vector

Exploitation requires an attacker within Bluetooth adjacent-network range capable of establishing or tearing down an SCO connection. By timing a controller-initiated disconnect to race a local socket close(), the attacker forces the reference-count underflow and drives execution into freed memory. No authentication or user interaction is required.

No verified public exploitation code is available. See the upstream commits for the technical fix: Kernel Git Commit 8fe6271, Kernel Git Commit a33bc07, and Kernel Git Commit abd93c8.

Detection Methods for CVE-2026-80683

Indicators of Compromise

Kernel log entries reporting refcount_t: underflow or KASAN: slab-use-after-free in sco_conn_put.
Unexpected crashes or oopses in the hci_rx_work workqueue involving hci_disconn_complete_evt or sco_conn_del.
Bluetooth stack instability coinciding with rapid SCO connect/disconnect cycles from nearby devices.

Detection Strategies

Enable KASAN on test and staging kernels to catch use-after-free conditions in the SCO path before production deployment.
Monitor dmesg and /var/log/kern.log for reference-count underflow warnings tied to Bluetooth symbols.
Correlate Bluetooth Host Controller Interface (HCI) disconnect events with process crashes to identify potential race triggering.

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on sco_conn_put, refcount_t, or KASAN strings.
Track Bluetooth adapter status changes and abnormal reconnect patterns on managed endpoints.
Baseline expected SCO usage and flag hosts exhibiting anomalous audio-profile churn.

How to Mitigate CVE-2026-80683

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 8fe6271, a33bc07, and abd93c8 as soon as vendor builds are available.
Rebuild or update distribution kernels to a version incorporating the SCO reference-ownership fix and reboot affected hosts.
Inventory endpoints with active Bluetooth radios and prioritize patching on mobile, laptop, and IoT fleets.

Patch Information

The fix gives the socket its own counted sco_conn reference. __sco_chan_add() now takes a reference that is released together with the channel in sco_chan_del() and in sco_sock_destruct(). sco_conn_del() no longer performs the extra put, and the redundant hci_conn_hold() in sco_conn_ready() is removed. sco_conn_add() consumes one hci_conn reference for the lifetime of the sco_conn, and sco_connect_cfm() explicitly takes a reference before handing it off. Patch sources: Kernel Git Commit 8fe6271, Kernel Git Commit a33bc07, Kernel Git Commit abd93c8.

Workarounds

Disable the Bluetooth stack on systems that do not require it by unloading the bluetooth and btusb kernel modules and blacklisting them.
Turn off the Bluetooth radio via firmware or hardware controls on endpoints where wireless audio is not needed.
Restrict pairing to trusted devices and disable SCO audio profiles at the userspace stack level where feasible.

bash

# Configuration example
sudo systemctl stop bluetooth
sudo systemctl disable bluetooth
echo 'blacklist bluetooth' | sudo tee /etc/modprobe.d/blacklist-bluetooth.conf
echo 'blacklist btusb' | sudo tee -a /etc/modprobe.d/blacklist-bluetooth.conf
sudo rmmod btusb bluetooth 2>/dev/null || true