In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()… (CVE-2026-99011)

The Linux kernel Bluetooth SCO subsystem had a vulnerability where sco_recv_scodata() upgraded a weak back-pointer to a strong reference under a lock, but the pointer could be cleared without holding that lock. This caused a race condition where the RX path could access a freed sco_conn object, triggering a use-after-free error detected by KASAN. The fix introduces proper reference counting and locking to serialize access to the sco_conn pointer, ensuring the object cannot be freed while still referenced. Additionally, ownership of related hci_conn references was adjusted to avoid regressions in socket close behavior.

This vulnerability could lead to a kernel use-after-free condition, potentially causing system instability or crashes. There is no indication of remote code execution or privilege escalation in the provided data. Exploitation could result in denial of service due to kernel crashes.

A fix has been applied in the Linux kernel to properly serialize access to the sco_conn object and manage its lifetime with correct locking and reference counting. Users should update to the fixed kernel version once available. Patch status is not yet confirmed in the provided data — check the vendor advisory for current remediation guidance.