Loading story…
A use-after-free flaw in the Linux kernel's Bluetooth SCO implementation, tracked as CVE-2026-31408, was fixed after maintainers found that sco_recv_frame() could access a socket after it had been freed during a concurrent close(). The bug stems from reading conn->sk while holding sco_conn_lock() and then releasing the lock before safely retaining a socket reference, creating a race that can lead to memory corruption or a denial of service. Upstream records say the vulnerable code path existed since Linux 2.6.12, and the fix adds sco_sock_hold() before unlocking along with sock_put() on all exit paths.
The Linux kernel CVE team published fixes across multiple stable branches, including 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0-rc6, and advised users to move to the latest stable kernel rather than cherry-picking patches. Red Hat rated the issue Moderate for its products, assigned a CVSS v3 score of 7.0, and said updated kernel packages were released for multiple Red Hat Enterprise Linux lines, including RHEL 8, 9, and 10 and related support variants; upstream CVE scoring lists the flaw at 8.8 under adjacent-network Bluetooth attack conditions.
See real exploitation activity before you spend the cycle.
10 events from the most recent confirmed update back to the earliest known activity.
Red Hat listed Red Hat Enterprise Linux 10 kernel packages as fixed for CVE-2026-31408 via advisory RHSA-2026:19569.
Red Hat published a customer portal CVE entry describing CVE-2026-31408 as a moderate-severity use-after-free in the Linux kernel Bluetooth SCO implementation. The entry linked the issue to Bugzilla 2455334.
The vulnerability was fixed upstream by taking a socket reference with sco_sock_hold() before releasing the lock and adding sock_put() on exit paths. The fix was released in Linux 6.6.131, 6.12.80, 6.18.21, 6.19.11, and 7.0-rc6.
The Linux kernel CVE team assigned CVE-2026-31408 to the Bluetooth SCO use-after-free vulnerability in sco_recv_frame(). The issue was publicly announced through the linux-cve-announce channel.
Red Hat released fixes for Red Hat Enterprise Linux 8.8 Telecommunications Update Service and 8.8 Update Services for SAP Solutions via RHSA-2026:40760.
Red Hat listed Red Hat Enterprise Linux 10.0 Extended Update Support kernel packages as fixed for CVE-2026-31408 in RHSA-2026:39371.
Red Hat released fixes for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On, as well as RHEL 8.6 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On, through RHSA-2026:35896 and RHSA-2026:35894.
Red Hat's CVE page for CVE-2026-31408 was last modified, reflecting updated product fix information and metadata for the issue.
Red Hat listed fixes for Red Hat Enterprise Linux 8 kernel and RHEL 8 kernel-rt packages in advisories RHSA-2026:21706 and RHSA-2026:21745.
The vulnerable logic in net/bluetooth/sco.c was introduced in Linux 2.6.12, creating a race in sco_recv_frame() where conn->sk could be freed after sco_conn_lock() was released but before later use.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
bugzilla.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A use-after-free flaw in the Linux kernel Bluetooth HCI SCO subsystem, tracked as **CVE-2021-3640**, can allow a local privileged attacker to crash a host or escalate privileges. The vulnerability stems from a race involving `sco_sock_sendmsg()` and `sco_conn_del()`; it can be triggered through `UFFDIO_REGISTER` or a comparable mechanism by an attacker holding `CAP_NET_ADMIN` in the initial user namespace. Red Hat assigned the issue a **Moderate** severity rating with a CVSS v3.1 score of **6.7** and classified it as CWE-825, expired pointer dereference. Fixed `kernel` and `kernel-rt` packages were released for Red Hat Enterprise Linux 8 and 9, with further fixes for RHEL 8.6 EUS and Red Hat Virtualization; RHEL 6 is unaffected, while out-of-support RHEL 7 kernel variants should be treated as potentially affected.
Aug 26, 2026
**CVE-2023-51779** is a use-after-free flaw in the Linux kernel Bluetooth subsystem caused by a race between `bt_sock_recvmsg()` and `bt_sock_ioctl()` over a socket buffer. A local low-privileged user could trigger a denial of service and may potentially execute code; Red Hat rates the issue Moderate, with CVSS 7.0, while noting exploitation is difficult and local privilege escalation has not been confirmed. The upstream fix is available in commit `2e07e8348ea454615e268222ae3fc240421be768`, and Fedora addressed the issue in its 6.6.9 stable kernel updates. Red Hat released fixes for affected RHEL 8 and 9 streams, including RHSA-2024:3859 for supported RHEL 8.6 extended-support variants, which provides kernel `4.18.0-372.107.1.el8_6`; affected systems require a reboot after installation. RHEL 6 is outside support scope and should be considered affected.
Aug 26, 2026
Red Hat disclosed **CVE-2025-39981**, a Linux kernel flaw in the Bluetooth management subsystem that can trigger a **use-after-free** or double-free condition in `mgmt_pending` handling. The bug was traced to `struct mgmt_pending` objects being freed while still in use, with a KASAN report identifying a slab use-after-free in `mgmt_add_adv_patterns_monitor_sync`. Red Hat rated the issue **Moderate** with a **CVSS v3 score of 7.3**, warning that a local attacker able to interact with the Bluetooth subsystem could cause memory corruption leading to denial of service or possible privilege escalation. The weakness maps to **`CWE-416` (Use After Free)**, a class of memory-safety bugs that can enable crashes, information disclosure, or arbitrary code execution when freed memory is later referenced. The kernel fix adds `mgmt_pending_valid` checks and removes commands from the pending list while holding `mgmt_pending_lock` to prevent TOCTOU-related misuse. Red Hat said fixes were shipped for multiple **RHEL 8, 9, and 10** kernel packages, while **RHEL 6** was not affected because the vulnerable code is absent; the company also recommended hardening or disabling Bluetooth management interfaces where they are not needed.
Aug 25, 2026