Loading vulnerability…
Use-after-free in Linux kernel Bluetooth SCO socket handling
CVE-2026-89774 is a use-after-free vulnerability in the Linux kernel Bluetooth SCO subsystem. The sco_conn_ready() function accesses conn->sk and a listening parent socket without sufficient locking or reference counting, allowing concurrent socket closure to free a socket before it is dereferenced. Socket validity is also not adequately rechecked after acquiring the socket lock. A similar lifetime-management issue affects sockets returned by sco_get_sock_listen(). The race can cause access to freed kernel memory and is associated with elevation of privilege.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may allow elevation of privilege through a use-after-free in kernel-space Bluetooth socket handling. Dereferencing the freed socket may also cause a kernel crash and denial of service. The precise privileges obtainable and a reliable exploitation method are not established.
If you can’t patch tonight, do this now.
Until a patched kernel is deployed, disable or restrict Bluetooth functionality where operationally feasible and limit exposure to untrusted Bluetooth SCO connections. No workaround that corrects the underlying socket-lifetime race is documented.
Patch, then assume compromise.
Install a vendor-supported Linux kernel update containing the Bluetooth SCO socket-lifetime fix and reboot into the updated kernel. The fix holds socket references in sco_conn_ready(), makes sco_get_sock_listen() acquire a reference, revalidates socket state after lock_sock(), and protects conn->sk access with the associated socket lock. For affected Android devices, apply the applicable November 2026 vendor security update; security patch level 2026-11-05 is recommended where available. Exact upstream fixed kernel versions are not available.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.