CVE-2026-99011 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems that utilize Bluetooth SCO functionality. Linux kernel developers and maintainers should review and apply patches to address the vulnerability. Linux distribution vendors should update their kernels to include the fix and notify their users. Users of Linux-based systems that utilize Bluetooth SCO functionality should ensure that their systems are updated

Why it matters

The CVE-2026-99011 vulnerability in the Linux kernel's Bluetooth SCO implementation requires immediate attention from Linux kernel developers, maintainers, and users. A use-after-free condition can lead to denial-of-service attacks or potential code execution. Verification of affected versions, remediation priority, exposure assessment, and inventory checks are necessary to determine the impact on Linux-based systems.

• Denial-of-service (DoS) attacks may be possible due to the use-after-free condition.
• Potential code execution may occur if an attacker can trigger the use-after-free condition.
• The vulnerability requires verification of affected versions and remediation priority.
• Exposure assessment and inventory checks are necessary to determine the impact on Linux-based systems.

Technical summary

The vulnerability exists in the Linux kernel's Bluetooth SCO implementation, specifically in the sco_recv_scodata() function. The function upgrades the weak hcon->sco_data back-pointer to a strong reference under hdev->lock, but the pointer is cleared from the other side without that lock. This can lead to a use-after-free condition when the last sco_conn reference is dropped. The issue arises from the lack of proper synchronization between the sco_recv_scodata() function and the sco_conn_free() function, leading to a potential use-after-free condition. This could allow an attacker to cause a denial-of-service or potentially execute arbitrary code. The vulnerability requires verification of affected versions,

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor the Linux kernel's Bluetooth SCO implementation for potential use-after-free conditions
• Perform an inventory of Linux-based systems that utilize Bluetooth SCO functionality
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is caused by the sco_recv_scodata() function upgrading the weak hcon->sco_data back-pointer to a strong reference under hdev->lock, while the pointer is cleared from the other side without that lock. This can lead to a use-after-free condition when the last sco_conn reference is dropped.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.