{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-50125", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-10-21T19:36:19.954Z", "datePublished": "2024-11-05T17:10:53.090Z", "dateUpdated": "2026-08-19T16:27:45.098Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:27:45.098Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix UAF on sco_sock_timeout\n\nconn->sk maybe have been unlinked/freed while waiting for sco_conn_lock\nso this checks if the conn->sk is still valid by checking if it part of\nsco_sk_list."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable path lives in the Bluetooth SCO stack and only executes when `conn->hcon` is non-NULL, i.e. an actual SCO/eSCO link exists with an in-range Bluetooth peer; `sco_conn_del()` (the second patched call site) is driven directly by `sco_connect_cfm`/`sco_disconn_cfm` from the adjacent device. Bluetooth radio proximity is required, matching the Adjacent classification.\nAC:L - The attacker controls both sides of the race: `SO_SNDTIMEO` sets `sk->sk_sndtimeo`, which `sco_connect()` passes verbatim to `sco_sock_set_timer()`, so the timeout work can be scheduled to fire at an arbitrarily chosen moment and raced against `close()`, and `sco_sock_clear_timer()` uses non-sync `cancel_delayed_work()` so an in-flight work item is never waited for. syzbot produced a reproducer and confirmed the fix.\nPR:L - There is no `capable()` or `CAP_NET_*` check anywhere in `sco_sock_create/bind/listen/connect`, so any unprivileged local user can create SCO sockets and drive the connect/close sequence that frees the socket. Only basic local account access is needed, not root.\nUI:N - The whole sequence \u2014 socket creation, `SO_SNDTIMEO`, connect, close \u2014 is performed by the attacker's own process against a system Bluetooth adapter. No victim action is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - A use-after-free on `struct sock` lets the attacker respray the freed slab object and read back its contents through subsequent socket operations, giving a path to arbitrary kernel memory disclosure.\nI:H - The stale pointer is written through \u2014 `sock_hold()` performs an atomic increment on freed memory and `sk->sk_err = ETIMEDOUT` writes into it \u2014 and `sk->sk_state_change(sk)` performs an indirect call through a function pointer read from the freed object, providing a control-flow hijack primitive.\nA:H - Even without successful exploitation the UAF produces a KASAN splat / kernel oops or panic in `sco_sock_timeout()`, and it can be triggered repeatedly by an unprivileged process."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/bluetooth.h", "net/bluetooth/af_bluetooth.c", "net/bluetooth/sco.c"], "versions": [{"version": "a1073aad497d0d071a71f61b721966a176d50c08", "lessThan": "678386459ffc07d2fbfbfe33456013786975cfef", "status": "affected", "versionType": "git"}, {"version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "74a466a15731a754bcd8b5a83c126b5122e15a45", "status": "affected", "versionType": "git"}, {"version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "9ddda5d967e84796e7df1b54a55f36b4b9f21079", "status": "affected", "versionType": "git"}, {"version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "d30803f6a972b5b9e26d1d43b583c7ec151de04b", "status": "affected", "versionType": "git"}, {"version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "80b05fbfa998480fb3d5299d93eab946f51e9c36", "status": "affected", "versionType": "git"}, {"version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "1bf4470a3939c678fb822073e9ea77a0560bc6bb", "status": "affected", "versionType": "git"}, {"version": "fea63ccd928c01573306983346588b26cffb5572", "status": "affected", "versionType": "git"}, {"version": "48669c81a65628ef234cbdd91b9395952c7c27fe", "status": "affected", "versionType": "git"}, {"version": "37d7ae2b0578f2373674a755402ee722e96edc08", "status": "affected", "versionType": "git"}, {"version": "ec1f74319bb35c1c90c25014ec0f6ea6c3ca2134", "status": "affected", "versionType": "git"}, {"version": "b657bba82ff6a007d84fd076bd73b11131726a2b", "status": "affected", "versionType": "git"}, {"version": "5.10.67", "lessThan": "5.10.265", "status": "affected", "versionType": "semver"}, {"version": "4.14.263", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.207", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.148", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.13.19", "lessThan": "5.14", "status": "affected", "versionType": "semver"}, {"version": "5.14.6", "lessThan": "5.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/bluetooth/bluetooth.h", "net/bluetooth/af_bluetooth.c", "net/bluetooth/sco.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.181", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.115", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.59", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.11.6", "lessThanOrEqual": "6.11.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.67", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "5.15.181"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.11.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.263"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.207"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/678386459ffc07d2fbfbfe33456013786975cfef"}, {"url": "https://git.kernel.org/stable/c/74a466a15731a754bcd8b5a83c126b5122e15a45"}, {"url": "https://git.kernel.org/stable/c/9ddda5d967e84796e7df1b54a55f36b4b9f21079"}, {"url": "https://git.kernel.org/stable/c/d30803f6a972b5b9e26d1d43b583c7ec151de04b"}, {"url": "https://git.kernel.org/stable/c/80b05fbfa998480fb3d5299d93eab946f51e9c36"}, {"url": "https://git.kernel.org/stable/c/1bf4470a3939c678fb822073e9ea77a0560bc6bb"}], "title": "Bluetooth: SCO: Fix UAF on sco_sock_timeout", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-50125", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-11T14:25:55.353607Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T14:58:33.667Z"}}, {"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:25:44.566Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:25:44.566Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-50125", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-12-11T14:25:55.353607Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-12-11T14:25:56.511Z"}}], "cna": {"title": "Bluetooth: SCO: Fix UAF on sco_sock_timeout", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:A - The vulnerable path lives in the Bluetooth SCO stack and only executes when `conn->hcon` is non-NULL, i.e. an actual SCO/eSCO link exists with an in-range Bluetooth peer; `sco_conn_del()` (the second patched call site) is driven directly by `sco_connect_cfm`/`sco_disconn_cfm` from the adjacent device. Bluetooth radio proximity is required, matching the Adjacent classification.\nAC:L - The attacker controls both sides of the race: `SO_SNDTIMEO` sets `sk->sk_sndtimeo`, which `sco_connect()` passes verbatim to `sco_sock_set_timer()`, so the timeout work can be scheduled to fire at an arbitrarily chosen moment and raced against `close()`, and `sco_sock_clear_timer()` uses non-sync `cancel_delayed_work()` so an in-flight work item is never waited for. syzbot produced a reproducer and confirmed the fix.\nPR:L - There is no `capable()` or `CAP_NET_*` check anywhere in `sco_sock_create/bind/listen/connect`, so any unprivileged local user can create SCO sockets and drive the connect/close sequence that frees the socket. Only basic local account access is needed, not root.\nUI:N - The whole sequence \u2014 socket creation, `SO_SNDTIMEO`, connect, close \u2014 is performed by the attacker's own process against a system Bluetooth adapter. No victim action is required.\nS:U - The use-after-free corrupts kernel heap memory within the same kernel security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - A use-after-free on `struct sock` lets the attacker respray the freed slab object and read back its contents through subsequent socket operations, giving a path to arbitrary kernel memory disclosure.\nI:H - The stale pointer is written through \u2014 `sock_hold()` performs an atomic increment on freed memory and `sk->sk_err = ETIMEDOUT` writes into it \u2014 and `sk->sk_state_change(sk)` performs an indirect call through a function pointer read from the freed object, providing a control-flow hijack primitive.\nA:H - Even without successful exploitation the UAF produces a KASAN splat / kernel oops or panic in `sco_sock_timeout()`, and it can be triggered repeatedly by an unprivileged process."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a1073aad497d0d071a71f61b721966a176d50c08", "lessThan": "678386459ffc07d2fbfbfe33456013786975cfef", "versionType": "git"}, {"status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "74a466a15731a754bcd8b5a83c126b5122e15a45", "versionType": "git"}, {"status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "9ddda5d967e84796e7df1b54a55f36b4b9f21079", "versionType": "git"}, {"status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "d30803f6a972b5b9e26d1d43b583c7ec151de04b", "versionType": "git"}, {"status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "80b05fbfa998480fb3d5299d93eab946f51e9c36", "versionType": "git"}, {"status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "lessThan": "1bf4470a3939c678fb822073e9ea77a0560bc6bb", "versionType": "git"}, {"status": "affected", "version": "fea63ccd928c01573306983346588b26cffb5572", "versionType": "git"}, {"status": "affected", "version": "48669c81a65628ef234cbdd91b9395952c7c27fe", "versionType": "git"}, {"status": "affected", "version": "37d7ae2b0578f2373674a755402ee722e96edc08", "versionType": "git"}, {"status": "affected", "version": "ec1f74319bb35c1c90c25014ec0f6ea6c3ca2134", "versionType": "git"}, {"status": "affected", "version": "b657bba82ff6a007d84fd076bd73b11131726a2b", "versionType": "git"}, {"status": "affected", "version": "5.10.67", "lessThan": "5.10.265", "versionType": "semver"}, {"status": "affected", "version": "4.14.263", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.207", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.148", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.13.19", "lessThan": "5.14", "versionType": "semver"}, {"status": "affected", "version": "5.14.6", "lessThan": "5.15", "versionType": "semver"}], "programFiles": ["include/net/bluetooth/bluetooth.h", "net/bluetooth/af_bluetooth.c", "net/bluetooth/sco.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.181", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.115", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.59", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.11.6", "versionType": "semver", "lessThanOrEqual": "6.11.*"}, {"status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/bluetooth/bluetooth.h", "net/bluetooth/af_bluetooth.c", "net/bluetooth/sco.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/678386459ffc07d2fbfbfe33456013786975cfef"}, {"url": "https://git.kernel.org/stable/c/74a466a15731a754bcd8b5a83c126b5122e15a45"}, {"url": "https://git.kernel.org/stable/c/9ddda5d967e84796e7df1b54a55f36b4b9f21079"}, {"url": "https://git.kernel.org/stable/c/d30803f6a972b5b9e26d1d43b583c7ec151de04b"}, {"url": "https://git.kernel.org/stable/c/80b05fbfa998480fb3d5299d93eab946f51e9c36"}, {"url": "https://git.kernel.org/stable/c/1bf4470a3939c678fb822073e9ea77a0560bc6bb"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix UAF on sco_sock_timeout\n\nconn->sk maybe have been unlinked/freed while waiting for sco_conn_lock\nso this checks if the conn->sk is still valid by checking if it part of\nsco_sk_list."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "5.10.67"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.181", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.115", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.59", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.11.6", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.263"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.207"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.148"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.13.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.14.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-19T16:27:45.098Z"}}}, "cveMetadata": {"cveId": "CVE-2024-50125", "state": "PUBLISHED", "dateUpdated": "2026-08-19T16:27:45.098Z", "dateReserved": "2024-10-21T19:36:19.954Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-11-05T17:10:53.090Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/bluetooth/bluetooth.h", "net/bluetooth/af_bluetooth.c", "net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "678386459ffc07d2fbfbfe33456013786975cfef", "status": "affected", "version": "a1073aad497d0d071a71f61b721966a176d50c08", "versionType": "git"}, {"lessThan": "74a466a15731a754bcd8b5a83c126b5122e15a45", "status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "versionType": "git"}, {"lessThan": "9ddda5d967e84796e7df1b54a55f36b4b9f21079", "status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "versionType": "git"}, {"lessThan": "d30803f6a972b5b9e26d1d43b583c7ec151de04b", "status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "versionType": "git"}, {"lessThan": "80b05fbfa998480fb3d5299d93eab946f51e9c36", "status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "versionType": "git"}, {"lessThan": "1bf4470a3939c678fb822073e9ea77a0560bc6bb", "status": "affected", "version": "ba316be1b6a00db7126ed9a39f9bee434a508043", "versionType": "git"}, {"status": "affected", "version": "fea63ccd928c01573306983346588b26cffb5572", "versionType": "git"}, {"status": "affected", "version": "48669c81a65628ef234cbdd91b9395952c7c27fe", "versionType": "git"}, {"status": "affected", "version": "37d7ae2b0578f2373674a755402ee722e96edc08", "versionType": "git"}, {"status": "affected", "version": "ec1f74319bb35c1c90c25014ec0f6ea6c3ca2134", "versionType": "git"}, {"status": "affected", "version": "b657bba82ff6a007d84fd076bd73b11131726a2b", "versionType": "git"}, {"lessThan": "5.10.265", "status": "affected", "version": "5.10.67", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.263", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.207", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.148", "versionType": "semver"}, {"lessThan": "5.14", "status": "affected", "version": "5.13.19", "versionType": "semver"}, {"lessThan": "5.15", "status": "affected", "version": "5.14.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/bluetooth/bluetooth.h", "net/bluetooth/af_bluetooth.c", "net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.181", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.115", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.59", "versionType": "semver"}, {"lessThanOrEqual": "6.11.*", "status": "unaffected", "version": "6.11.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.12", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7A9290B0-2AD4-446E-B1DB-DA1FA8D39207", "versionEndExcluding": "6.1.115", "versionStartIncluding": "5.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D15CA59-D15C-4ACD-8B03-A072DEAD2081", "versionEndExcluding": "6.6.59", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E4486B12-007B-4794-9857-F07145637AA1", "versionEndExcluding": "6.11.6", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.14.263:*:*:*:*:*:*:*", "matchCriteriaId": "C20561F0-C119-4858-8A45-53627BDB3A85", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:4.19.207:*:*:*:*:*:*:*", "matchCriteriaId": "FE4696E1-1AF7-48BF-A760-D1647592A16C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.4.148:*:*:*:*:*:*:*", "matchCriteriaId": "EB3797F7-1847-4EA2-9831-1204B46DDBA6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.10.67:*:*:*:*:*:*:*", "matchCriteriaId": "3D53E7BD-B23C-452F-8A0A-5C0A9F3B544D", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.13.19:*:*:*:*:*:*:*", "matchCriteriaId": "6EE38667-C006-40E7-9160-BA9129F4EB63", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.14.6:*:*:*:*:*:*:*", "matchCriteriaId": "4D94E8C9-DE54-40B9-97B2-454977B0E224", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc1:*:*:*:*:*:*", "matchCriteriaId": "7F361E1D-580F-4A2D-A509-7615F73167A1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc2:*:*:*:*:*:*", "matchCriteriaId": "925478D0-3E3D-4E6F-ACD5-09F28D5DF82C", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc3:*:*:*:*:*:*", "matchCriteriaId": "3C95E234-D335-4B6C-96BF-E2CEBD8654ED", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.12:rc4:*:*:*:*:*:*", "matchCriteriaId": "E0F717D8-3014-4F84-8086-0124B2111379", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: SCO: Fix UAF on sco_sock_timeout\n\nconn->sk maybe have been unlinked/freed while waiting for sco_conn_lock\nso this checks if the conn->sk is still valid by checking if it part of\nsco_sk_list."}, {"lang": "es", "value": " En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Bluetooth: SCO: Se corrige que UAF en sco_sock_timeout conn->sk pueda haberse desvinculado/liberado mientras se esperaba sco_conn_lock, por lo que esto verifica si conn->sk a\u00fan es v\u00e1lido verificando si es parte de sco_sk_list."}], "id": "CVE-2024-50125", "lastModified": "2026-08-19T17:18:34.767", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-50125", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-12-11T14:25:55.353607Z", "version": "2.0.3"}}]}, "published": "2024-11-05T18:15:15.550", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bf4470a3939c678fb822073e9ea77a0560bc6bb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/678386459ffc07d2fbfbfe33456013786975cfef"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/74a466a15731a754bcd8b5a83c126b5122e15a45"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/80b05fbfa998480fb3d5299d93eab946f51e9c36"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9ddda5d967e84796e7df1b54a55f36b4b9f21079"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d30803f6a972b5b9e26d1d43b583c7ec151de04b"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"affected_release": [{"advisory": "RHSA-2024:11486", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.19.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-19T00:00:00Z"}, {"advisory": "RHSA-2024:11486", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.19.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-12-19T00:00:00Z"}], "bugzilla": {"description": "kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout", "id": "2323937", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2323937"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.1", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "status": "verified"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nBluetooth: SCO: Fix UAF on sco_sock_timeout\nconn->sk maybe have been unlinked/freed while waiting for sco_conn_lock\nso this checks if the conn->sk is still valid by checking if it part of\nsco_sk_list.", "A use-after-free vulnerability was found in the Linux kernel's Bluetooth SCO. When sco_sock_timeout() is called, conn->sk may be unlinked/freed while waiting for sco_conn_lock. This checks if the conn->sk is still valid by checking if it is part of\nsco_sk_list, leading to a loss of availability and system confidentiality."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-50125", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-11-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-50125\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-50125\nhttps://lore.kernel.org/linux-cve-announce/2024110557-CVE-2024-50125-5fd3@gregkh/T"], "threat_severity": "Moderate"}

{}