CVE-2026-80683

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth SCO (Synchronous Connection-Oriented) implementation where the sco conn del() function drops a reference it does not own. This occurs because the socket stores the connection without holding its own reference, relying instead on references held by callers. A race condition between the close() function and the controller's Disconnection Complete event can lead to a slab-use-after-free scenario. Specifically, when sco chan del() clears the socket reference while sco conn del() is executing, the reference count can underflow, causing the connection to be freed and subsequently resulting in a write operation to the freed memory via sco conn put().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.