CVE-2026-89774: Linux Kernel Bluetooth SCO UAF Vulnerability

CVE-2026-89774 Overview

CVE-2026-89774 is a use-after-free vulnerability in the Linux kernel's Bluetooth Synchronous Connection-Oriented (SCO) subsystem. The flaw resides in the sco_conn_ready() function, which dereferences a socket pointer without holding conn->lock or a reference count. A concurrent sco_sock_release() on another task can null out conn->sk and free the socket while sco_conn_ready() still holds a stale pointer, leading to a use-after-free on sk. The same class of race affects the return value of sco_get_sock_listen(). An adjacent Bluetooth-range attacker can trigger this race to corrupt kernel memory, potentially achieving code execution or denial of service.

Critical Impact
A race condition in the Bluetooth SCO stack allows an adjacent attacker to trigger a use-after-free in kernel memory, threatening confidentiality, integrity, and availability of the host.

Affected Products

Linux kernel Bluetooth subsystem (SCO transport)
Linux kernel versions prior to the fixes referenced in the stable tree commits
Any distribution shipping an unpatched upstream kernel with Bluetooth SCO enabled

Discovery Timeline

2026-09-16 - CVE-2026-89774 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-89774

Vulnerability Analysis

The vulnerability is a socket-level use-after-free triggered by a race between SCO connection setup and socket release. In sco_conn_ready(), the kernel reads sk = conn->sk and later calls lock_sock(sk). Between those operations, a parallel sco_sock_release() on another CPU can acquire lock_sock(sk), set conn->sk = NULL, release the socket, and invoke sco_sock_kill(sk). When sco_conn_ready() resumes, it dereferences a socket that has already been destroyed.

The same unsafe access pattern applies to the parent socket returned by sco_get_sock_listen(), which was accessed without a refcount and without checking parent->sk_state. The upstream fix takes a refcount on sk in sco_conn_ready(), increments the refcount inside sco_get_sock_listen(), and re-validates socket state after lock_sock(). The patch also extends conn->sk locking to be protected by lock_sock() of the associated socket.

Root Cause

The root cause is missing synchronization on conn->sk and the listening parent socket. The kernel dereferenced these pointers outside of conn->lock and without holding a reference, violating the socket lifetime rules and enabling a classic time-of-check to time-of-use race.

Attack Vector

Exploitation requires adjacent-network access over Bluetooth. An attacker within Bluetooth range initiates or manipulates SCO connection state transitions while the target application closes SCO sockets, racing sco_conn_ready() against sco_sock_release(). Successful exploitation can yield kernel memory corruption. See the upstream commits for the exact patch mechanics rather than synthetic exploitation code.

// No verified proof-of-concept code is available for CVE-2026-89774.
// Refer to the upstream kernel commits for the authoritative fix:
//   4e37f645, 50aae396, 6e384057, 7199c78c, 73cb063f, d141d9b7

Detection Methods for CVE-2026-89774

Indicators of Compromise

Kernel oops or panic traces referencing sco_conn_ready, sco_sock_kill, or sco_sock_release in dmesg or journalctl -k.
KASAN use-after-free reports naming the SCO socket structures on kernels built with CONFIG_KASAN.
Unexpected Bluetooth stack restarts (bluetoothd respawns) correlated with nearby Bluetooth pairing or SCO activity.

Detection Strategies

Monitor kernel ring buffer messages for repeated Bluetooth subsystem faults on hosts with CONFIG_BT_SCO enabled.
Correlate hci0 link events, SCO connection setup, and abnormal process terminations of Bluetooth audio services.
Track running kernel versions across the fleet and flag hosts without the stable commits 4e37f645, 50aae396, 6e384057, 7199c78c, 73cb063f, or d141d9b7.

Monitoring Recommendations

Forward kern.crit and kern.err facility logs to a central log store to identify SCO-related crash signatures.
Alert on any Bluetooth HCI device reset events on servers, kiosks, or workstations where Bluetooth is not required.
Baseline expected Bluetooth pairing behavior and investigate anomalous inbound connection attempts from unknown peers.

How to Mitigate CVE-2026-89774

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable commits 4e37f645, 50aae396, 6e384057, 7199c78c, 73cb063f, and d141d9b7.
Update to distribution kernels that incorporate the fix once vendors publish advisories.
Disable the Bluetooth stack on systems that do not require it by masking bluetooth.service and unloading the bluetooth and bt_sco-related modules.

Patch Information

The upstream fix modifies sco_conn_ready() to take a refcount on sk before lock_sock(), revalidates the socket after acquiring the lock, and makes sco_get_sock_listen() return a refcounted socket. It also tightens conn->sk protection under lock_sock(). Review the changes in the Kernel Git Commit 4e37f645, Kernel Git Commit 50aae396, Kernel Git Commit 6e384057, Kernel Git Commit 7199c78c, Kernel Git Commit 73cb063f, and Kernel Git Commit d141d9b7.

Workarounds

Block the bluetooth and bt_sco kernel modules via /etc/modprobe.d/ on systems where Bluetooth is not needed.
Power off Bluetooth radios on servers and untrusted environments using rfkill block bluetooth.
Restrict physical proximity and reduce Bluetooth discoverability on high-value endpoints until the kernel is patched.

bash

# Configuration example: disable Bluetooth SCO on unpatched hosts
echo 'install bluetooth /bin/true' | sudo tee /etc/modprobe.d/disable-bluetooth.conf
sudo systemctl mask bluetooth.service
sudo rfkill block bluetooth