PT-2026-30576 · Linux · Linux Kernel

Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-31408

Positive Technologies · (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description The Linux kernel contains a use-after-free issue in the sco recv frame() function within the Bluetooth SCO (Synchronous Connection-Oriented) subsystem. The function reads conn->sk under sco conn lock() but releases the lock without holding a reference to the socket. A concurrent close() operation could free the socket between the lock release and subsequent access to sk->sk state, leading to a use-after-free condition. The issue is fixed by using sco sock hold() to acquire a reference before releasing the lock and adding sock put() on all exit paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-31408

Affected Products

Linux Kernel

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-31408 · Security Note
• https://twitter.com/vuldb/status/2041069676692938849 · Twitter Post
• https://git.kernel.org/stable/c/e76e8f0581ef555eacc11dbb095e602fb30a5361 · Note
• https://git.kernel.org/stable/c/598dbba9919c5e36c54fe1709b557d64120cb94b · Note
• https://git.kernel.org/stable/c/45aaca995e4a7a05b272a58e7ab2fff4f611b8f1 · Note
• https://git.kernel.org/stable/c/7197462e90b8ce15caa1ae15d4bc2bb8cd21b11e · Note
• https://twitter.com/infoflowcloud/status/2041077619026792815 · Twitter Post
• https://git.kernel.org/stable/c/108b81514d8f2535eb16651495cefb2250528db3 · Note
• https://twitter.com/CVEnew/status/2041076955592728894 · Twitter Post