PT-2026-36440 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-02 · CVE-2026-43023

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the Bluetooth SCO component. The function sco sock connect() performs checks on sk state and sk type without holding the socket lock. This allows two concurrent connect() system calls on the same socket to pass the checks and enter sco connect(), which can lead to a use-after-free scenario. In this situation, a socket that has been closed and zapped can be revived to a connecting state, causing a double sock put() during cleanup and leaking connections.

Recommendations As a temporary workaround, restrict the use of the sco sock connect() function until a patch is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-43023

ECHO-6607-0635-9F57

Affected Products

Linux Kernel

References · 15

• https://git.kernel.org/stable/c/adb90cd0f9f7a8d438fcb93354040fbafc5ae2a0 · Patch
• https://ubuntu.com/security/CVE-2026-43023 · Vendor Advisory
• https://git.kernel.org/stable/c/dabf22269242e2f2bf44c43fcdc2fa763df7f9cc · Patch
• https://git.kernel.org/stable/c/98c8d3bfdaa657d8f472dbbebd7ea8cd816d8a8d · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43023 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43023 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43023 · Security Note
• https://git.kernel.org/stable/c/7e296ffdab5bdab718dff7c14288fdcb9154fa27 · Patch
• https://git.kernel.org/stable/c/d002bd11024bd231bcb606877e33951ffb7bed14 · Patch
• https://git.kernel.org/stable/c/8a5b0135d4a5d9683203a3d9a12a711ccec5936b · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43023 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-43023 · Vendor Advisory
• https://git.kernel.org/linus/8a5b0135d4a5d9683203a3d9a12a711ccec5936b · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-43023 · Note