PT-2026-30576 · Linux · Linux Kernel

Published 2026-04-06 · Updated 2026-05-28 · CVE-2026-31408

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description The Linux kernel contains a use-after-free issue in the sco recv frame() function within the Bluetooth SCO (Synchronous Connection-Oriented) subsystem. The function reads conn->sk under sco conn lock() but releases the lock without holding a reference to the socket. A concurrent close() operation could free the socket between the lock release and subsequent access to sk->sk state, leading to a use-after-free condition. The issue is fixed by using sco sock hold() to acquire a reference before releasing the lock and adding sock put() on all exit paths.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

CWE-911

Related Identifiers

ALSA-2026:21706

ALSA-2026:21745

BDU:2026-04925

CVE-2026-31408

ECHO-6F26-7F45-95A5

OESA-2026-1946

OESA-2026-1947

OESA-2026-1948

OESA-2026-1950

Affected Products

Linux Kernel

References · 101

• https://git.kernel.org/stable/c/598dbba9919c5e36c54fe1709b557d64120cb94b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23407 · Security Note
• https://git.kernel.org/stable/c/d57384e27d1ebf0047e3f00a6e1181b8be9857a2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38476 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23406 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23247 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50518 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-UBUNTU-2404-CVE-2026-31408 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31408 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2026-1948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23452 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31408 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31408 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23389 · Security Note
• https://git.kernel.org/stable/c/b0a7da0e3f7442545f071499beb36374714bb9de · Patch