CVE-2026-43023

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-43023 is a race condition vulnerability in the Linux kernel's Bluetooth Synchronous Connection-Oriented (SCO) implementation, specifically within the sco_sock_connect() function. This flaw occurs because the function checks the socket's sk_state and sk_type without holding the socket lock, allowing two concurrent connect() syscalls on the same socket to both pass the checks and proceed into sco_connect(). This leads to a use-after-free condition, exacerbated by an intervening HCI disconnect event that orphans a connection and revives a closed socket, resulting in double sock_put() calls and potential connection leaks.

A local attacker with low privileges (PR:L) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N) by orchestrating concurrent connect() syscalls on a Bluetooth SCO socket alongside precise timing of an HCI disconnect. Successful exploitation triggers a use-after-free on the socket structure, enabling high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H) as scored by CVSS 3.1 at 7.8. This could allow arbitrary code execution, denial of service, or data corruption in the kernel context.

Mitigation requires applying upstream patches from Linux kernel stable repositories, as detailed in the referenced commits (e.g., 7e296ffdab5bdab718dff7c14288fdcb9154fa27 and others). These fixes serialize concurrent connects by moving lock_sock() before state/type checks, add state re-checks after locking, prevent double-attachment of sockets to connections via sco_pi(sk)->conn validation in sco_chan_add(), correct error handling for sk_type checks, and invoke hci_conn_drop() on sco_chan_add failures to avoid HCI connection leaks. Security practitioners should update affected kernel versions promptly and audit Bluetooth SCO usage in local applications.