Race condition use-after-free in Linux kernel Bluetooth SCO sco_sock_connect()

A race condition in the Linux kernel Bluetooth SCO subsystem affects connection handling in sco_sock_connect(). The vulnerable logic checked sk_state and sk_type without holding the socket lock, allowing two concurrent connect() calls on the same socket to pass validation and enter sco_connect() simultaneously. In the documented failure mode, one thread attaches the socket to an SCO/HCI connection and transitions it to BT_CONNECT, while a concurrent disconnect path clears the association and moves the socket to BT_CLOSED with SOCK_ZAPPED. A second concurrent connect path can then continue and reattach the same socket to a new connection, effectively reviving a closed socket. This inconsistent lifecycle handling can trigger double sock_put() during cleanup, cause a kernel use-after-free, and leak the earlier connection object. The fix serializes connection attempts by taking lock_sock() before state and type checks, revalidates state inside sco_connect(), prevents double attachment in sco_chan_add(), corrects error handling for invalid socket type, and drops HCI connections on attach failure.