Linux/Unix 主機上安裝了一個或多個受到弱點影響的套件，且廠商未提供可用的修補程式。

  - Bluetooth： sco：修正 sco_sock_timeout（） 中的爭用情形 sco_sock_timeout（） 非同步執行和 lock_sock（sk）。如果通訊端在計時器執行時關閉，它會保持相同的鎖定 （lock_sock（sk）） 兩次，從而導致鎖死。CPU 0 CPU 1 ==================== ====================== sco_sock_close（） sco_sock_timeout（） lock_sock（sk） // <-- LOCK __sco_sock_close（） sco_chan_del（） sco_conn_put（） sco_conn_free（） disable_delayed_work_sync（） lock（sk） // <-- SAME LOCK 透過將 disable_delayed_work_sync（） 移至 lock_sock（sk） 之外來修正此問題，確保 sco_sock_timeout（） 之前沒有保留 lock_sock（sk）。Lockdep splat： 警告：偵測到可能的循環鎖定相依性 6.13.0-rc4 #7 未受污染 syz-executor292/9514 正在嘗試取得鎖定：ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： rcu_lock_acquire sect/v6.13-rc4/./include/linux/rcupdate.h：337 [inline] ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： rcu_read_lock sect/v6.13-rc4/./include/linux/rcupdate.h：849 [inline] ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： start_flush_work sect/v6.13-rc4/kernel/workqueue.c：4137 [inline] ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： __flush_work+0xd1/0xc40 sect/v6.13-rc4/kernel/workqueue.c：4195 但任務已持有鎖定： ffff88807db3a258 （sk_lock-AF_BLUETOOTH-BTPROTO_SCO）{+.+.}-{0:0}， at： lock_sock sect/v6.13-rc4/./include/net/sock.h：1623 [inline] ffff88807db3a258 （sk_lock-AF_BLUETOOTH-BTPROTO_SCO）{+.+.}-{0:0}， at： sco_sock_close+0x25/0x100 sect/v6.13-rc4/net/bluetooth/sco.c：524 其中已依賴於新鎖。 現有的相依性鏈結 （順序相反） 為： -> #1 （sk_lock-AF_BLUETOOTH-BTPROTO_SCO）{+.+.}-{0:0}：
    lock_acquire+0x1c4/0x520 sect/v6. 13-rc4/kernel/locking/lockdep.c：5849 lock_sock_nested+0x48/0x130 sect/v6.13-rc4/net/core/sock.c：3622 lock_sock sect/v6.13-rc4/./include/net/sock.h：1623 [內嵌] sco_sock_timeout+0xbe/0x270 sect/v6.13-rc4/net/bluetooth/sco.c：158 process_one_work sect/v6.13-rc4/kernel/workqueue.c：3229 [內嵌] process_scheduled_works+0xa99/0x18f0 sect/v6.13-rc4/kernel/workqueue.c：3310 worker_thread+0x8a9/0xd80 sect/v6.13-rc4/kernel/workqueue.c：3391 kthread+0x2c6/0x360 sect/v6.13-rc4/kernel/kthread.c：389 ret_from_fork+0x4e/0x80 sect/v6.13-rc4/arch/x86/kernel/process.c：147 ret_from_fork_asm+0x1a/0x30 sect/v6.13-rc4/arch/x86/entry/entry_64.S：244 -> #0 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}： check_prev_add sect/v6.13-rc4/kernel/locking/lockdep.c：3161 [inline] check_prevs_add sect/v6.13-rc4/kernel/locking/lockdep.c：3280 [inline] validate_chain+0x1888/0x5760 sect/v6.13-rc4/kernel/locking/lockdep.c：3904 __lock_acquire+0x13b4/0x2120 sect/v6.13-rc4/kernel/locking/lockdep.c：5226 lock_acquire+0x1c4/0x520 sect/v6.13-rc4/kernel/locking/lockdep.c：5849 touch_work_lockdep_map sect/v6.13-rc4/kernel/workqueue.c：3909 [inline] start_flush_work sect/v6.13-rc4/kernel/workqueue.v6.13-rc4/kernel/workqueue.v6.13-rc4/kernel/workqueue.v6.13c：4163 [inline] __flush_work+0x70f/0xc40 sect/v6.13-rc4/kernel/workqueue.c：4195 __cancel_work_sync sect/v6.13-rc4/kernel/workqueue.c：4351 [inline] disable_delayed_work_sync+0xbb/0xf0 sect/v6.13-rc4/kernel/workqueue.c：4514 sco_conn_free sect/v6.13-rc4/net/bluetooth/sco.c：95 [inline] kref_put sect/v6.13-rc4/./include/linux/kref.h：65 [inline] sco_conn_put+0x18f/0x270 sect/v6.13-rc4/net/bluetooth/sco.c：107 sco_chan_del+0xe2/0x210 sect/v6.13-rc4/net/bluetooth/sco.c：236 sco_sock_close+0x8f/0x100 sect/v6.13-rc4/net/bluetooth/sco.c：526 sco_sock_release+0x62/0x2d0 sect/v6.13-rc4/net/blueto ---truncated--- （CVE-2026-80666）

請注意，Nessus 的判定取決於廠商所報告的套件是否存在。

Linux/Unix 主机中安装的一个或多个程序包受到一个漏洞影响，而供应商没有提供补丁程序。

  - Bluetooth：sco：修复 sco_sock_timeout（） 中的争用条件 sco_sock_timeout（） 异步运行且 lock_sock（sk）。如果套接字在计时器运行时关闭，它会持有相同锁定 （lock_sock（sk）） 两次，导致死锁。CPU 0 CPU 1 ==================== ====================== sco_sock_close（） sco_sock_timeout（） lock_sock（sk） // <-- LOCK __sco_sock_close（） sco_chan_del（） sco_conn_put（） sco_conn_free（） disable_delayed_work_sync（） lock（sk） // <-- SAME LOCK 通过将 disable_delayed_work_sync（） 移到 lock_sock（sk） 之外，确保在 sco_sock_timeout（） 之前不保留任何 lock_sock（sk），修复此问题。Lockdep splat：警告：检测到可能的循环锁定依赖 6.13.0-rc4 #7 未受感染 syz-executor292/9514 is is trying to acquire lock： ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： rcu_lock_acquire sect/v6.13-rc4/./include/linux/rcupdate.h：337 [inline] ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： rcu_read_lock sect/v6.13-rc4/./include/linux/rcupdate.h：849 [inline] ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： start_flush_work sect/v6.13-rc4/kernel/workqueue.c：4137 [inline] ffff8881115d5070 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}， at： __flush_work+0xd1/0xc40 sect/v6.13-rc4/kernel/workqueue.c：4195 但任务已保持锁定： ffff88807db3a258 （sk_lock-AF_BLUETOOTH-BTPROTO_SCO）{+.+.}-{0:0}， at： lock_sock sect/v6.13-rc4/./include/net/sock.h：1623 [inline] ffff88807db3a258 （sk_lock-AF_BLUETOOTH-BTPROTO_SCO）{+.+.}-{0:0}， at： sco_sock_close+0x25/0x100 sect/v6.13-rc4/net/bluetooth/sco.c：524，该锁定已依赖新锁定。 现有依赖关系链（顺序相反）为：-> #1 （sk_lock-AF_BLUETOOTH-BTPROTO_SCO）{+.+.}-{0:0}：
    lock_acquire+0x1c4/0x520 sect/v6.13 13-rc4/kernel/locking/lockdep.c：5849 lock_sock_nested+0x48/0x130 sect/v6.13-rc4/net/core/sock.c：3622 lock_sock sect/v6.13-rc4/./include/net/sock.h：1623 [inline] sco_sock_timeout+0xbe/0x270 sect/v6.13-rc4/net/bluetooth/sco.c：158 process_one_work sect/v6.13-rc4/kernel/workqueue.c：3229 [inline] process_scheduled_works+0xa99/0x18f0 sect/v6.13-rc4/kernel/workqueue.c：3310 worker_thread+0x8a9/0xd80 sect/v6.13-rc4/kernel/workqueue.c：3391 kthread+0x2c6/0x360 sect/v6.13-rc4/kernel/kthread.c：389 ret_from_fork+0x4e/0x80 sect/v6.13-rc4/arch/x86/kernel/process.c：147 ret_from_fork_asm+0x1a/0x30 sect/v6.13-rc4/arch/x86/entry/entry_64.S：244 -> #0 （（work_completion）（&（&conn->timeout_work）->work））{+.+.}-{0:0}： check_prev_add sect/v6.13-rc4/kernel/locking/lockdep.c：3161 [inline] check_prevs_add sect/v6.13-rc4/kernel/locking/lockdep.c：3280 [inline] validate_chain+0x1888/0x5760 sect/v6.13-rc4/kernel/locking/lockdep.c：3904 __lock_acquire+0x13b4/0x2120 sect/v6.13-rc4/kernel/locking/lockdep.c：5226 lock_acquire+0x1c4/0x520 sect/v6.13-rc4/kernel/locking/lockdep.c：5849 touch_work_lockdep_map sect/v6.13-rc4/kernel/workqueue.c：3909 [inline] start_flush_work sect/v6.13-rc4/kernel/workqueue.v6.13-rc4/kernel/workqueue.c：4163 [inline] __flush_work+0x70f/0xc40 sect/v6.13-rc4/kernel/workqueue.c：4195 __cancel_work_sync sect/v6.13-rc4/kernel/workqueue.c：4351 [inline] disable_delayed_work_sync+0xbb/0xf0 sect/v6.13-rc4/kernel/workqueue.c：4514 sco_conn_free sect/v6.13-rc4/net/bluetooth/sco.c：95 [inline] kref_put sect/v6.13-rc4/./include/linux/kref.h：65 [inline] sco_conn_put+0x18f/0x270 sect/v6.13-rc4/net/bluetooth/sco.c：107 sco_chan_del+0xe2/0x210 sect/v6.13-rc4/net/bluetooth/sco.c：236 sco_sock_close+0x8f/0x100 sect/v6.13-rc4/net/bluetooth/sco.c：526 sco_sock_release+0x62/0x2d0 sect/v6.13-rc4/net/blueto ---truncated--- （CVE-2026-80666）

请注意，Nessus 依赖供应商报告的程序包是否存在进行判断。

Linux/Unix ホストには、ベンダーが提供するパッチが利用できない脆弱性の影響を受ける複数のパッケージがインストールされています。

  - Bluetooth:sco:sco_sock_timeout() の競合状態を修正します sco_sock_timeout() が非同期に実行され、lock_sock(sk) が実行されます。タイマーの実行中にソケットが閉じている場合、タイマーは同じロック(lock_sock(sk))を 2 回保持し、デッドロックにつながります。CPU 0 CPU 1 ==================== ====================== sco_sock_close() sco_sock_timeout() lock_sock(sk) // <-- LOCK __sco_sock_close() sco_chan_del() sco_conn_put() sco_conn_free() disable_delayed_work_sync() lock(sk) // <-- SAME LOCK disable_delayed_work_sync() を lock_sock(sk) の外側に移動し、sco_sock_timeout() の前に lock_sock(sk) が保持されないようにすることでこれを修正します。Lockdep splat:警告:循環ロック依存関係の可能性が検出されました 6.13.0-rc4 #7 汚染されていません syz-executor292/9514 がロックを取得しようとしています: ffff8881115d5070 ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}、at:rcu_lock_acquire sect/v6.13-rc4/./include/linux/rcupdate.h:337 [インライン] ffff8881115d5070 ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}, at: rcu_read_lock sect/v6.13-rc4/./include/linux/rcupdate.h:849 [inline] ffff8881115d5070 ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}, at: start_flush_work sect/v6.13-rc4/kernel/workqueue.c:4137 [inline] ffff8881115d5070 ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}、at:__flush_work+0xd1/0xc40 sect/v6.13-rc4/kernel/workqueue.c:4195 しかしタスクはすでにロックを保留しています: ffff88807db3a258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock sect/v6.13-rc4/./include/net/sock.h:1623 [インライン] ffff88807db3a258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}、at:sco_sock_close+0x25/0x100 sect/v6.13-rc4/net/bluetooth/sco.c:524 どのロックはすでに新しいロックに依存しています。 既存の依存関係チェーン(逆の順番)は次のとおりです。-> #1 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
    lock_acquire+0x1c4/0x520 sect/v6.13-rc4/kernel/locking/lockdep.c:5849 lock_sock_nested+0x48/0x130 sect/v6.13-rc4/net/core/sock.c:3622 lock_sock sect/v6.13-rc4/./include/net/sock.h:1623 [インライン] sco_sock_timeout+0xbe/0x270 sect/v6.13-rc4/net/bluetooth/sco.c:158 process_one_work sect/v6.13-rc4/kernel/workqueue.c:3229 [インライン] process_scheduled_works+0xa99/0x18f0 sect/v6.13-rc4/kernel/workqueue.c:3310 worker_thread+0x8a9/0xd80 sect/v6.13-rc4/kernel/workqueue.c:3391 kthread+0x2c6/0x360 sect/v6.13-rc4/kernel/kthread.c:389 ret_from_fork+0x4e/0x80 sect/v6.13-rc4/arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 sect/v6.13-rc4/arch/x86/entry/entry_64.S:244 -> #0 ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}: check_prev_add sect/v6.13-rc4/kernel/locking/lockdep.c:3161 [インライン] check_prevs_add sect/v6.13-rc4/kernel/locking/lockdep.c:3280 [インライン] validate_chain+0x1888/0x5760 sect/v6.13-rc4/kernel/locking/lockdep.c:3904 __lock_acquire+0x13b4/0x2120 sect/v6.13-rc4/kernel/locking/lockdep.c:5226 lock_acquire+0x1c4/0x520 sect/v6.13-rc4/kernel/locking/lockdep.c:5849 touch_work_lockdep_map sect/v6.13-rc4/kernel/workqueue.c:3909 [インライン] start_flush_work sect/v6.13-rc4/kernel/workqueue.v6.13-rc4/kernel/workqueue.v6.13-rc4/kernel/workqueue.v6.13c:4163 [インライン] __flush_work+0x70f/0xc40 sect/v6.13-rc4/kernel/workqueue.c:4195 __cancel_work_sync sect/v6.13-rc4/kernel/workqueue.c:4351 [インライン] disable_delayed_work_sync+0xbb/0xf0 sect/v6.13-rc4/kernel/workqueue.c:4514 sco_conn_free sect/v6.13-rc4/net/bluetooth/sco.c:95 [インライン] kref_put sect/v6.13-rc4/./include/linux/kref.h:65 [インライン] sco_conn_put+0x18f/0x270 sect/v6.13-rc4/net/bluetooth/sco.c:107 sco_chan_del+0xe2/0x210 sect/v6.13-rc4/net/bluetooth/sco.c:236 sco_sock_close+0x8f/0x100 sect/v6.13-rc4/net/bluetooth/sco.c:526 sco_sock_release+0x62/0x2d0 sect/v6.13-rc4/net/blueto ---truncated--- (CVE-2026-80666)

Nessus は、ベンダーから報告されたパッケージの存在に依存していることに注意してください。

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Bluetooth: sco: Fix a race condition in sco_sock_timeout() sco_sock_timeout() runs asynchronously and     lock_sock(sk). If the socket is closing while the timer is running, it holds the same lock (lock_sock(sk))     twice, leading to a deadlock. CPU 0 CPU 1 ==================== ====================== sco_sock_close()     sco_sock_timeout() lock_sock(sk) // <-- LOCK __sco_sock_close() sco_chan_del() sco_conn_put()     sco_conn_free() disable_delayed_work_sync() lock(sk) // <-- SAME LOCK Fix this by moving     disable_delayed_work_sync() outside of lock_sock(sk), ensuring that no lock_sock(sk) is held before     sco_sock_timeout(). Lockdep splat: WARNING: possible circular locking dependency detected 6.13.0-rc4 #7     Not tainted syz-executor292/9514 is trying to acquire lock: ffff8881115d5070     ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire     sect/v6.13-rc4/./include/linux/rcupdate.h:337 [inline] ffff8881115d5070     ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}, at: rcu_read_lock     sect/v6.13-rc4/./include/linux/rcupdate.h:849 [inline] ffff8881115d5070     ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}, at: start_flush_work     sect/v6.13-rc4/kernel/workqueue.c:4137 [inline] ffff8881115d5070     ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}, at: __flush_work+0xd1/0xc40     sect/v6.13-rc4/kernel/workqueue.c:4195 but task is already holding lock: ffff88807db3a258 (sk_lock-     AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: lock_sock sect/v6.13-rc4/./include/net/sock.h:1623 [inline]     ffff88807db3a258 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}, at: sco_sock_close+0x25/0x100     sect/v6.13-rc4/net/bluetooth/sco.c:524 which lock already depends on the new lock. the existing dependency     chain (in reverse order) is: -> #1 (sk_lock-AF_BLUETOOTH-BTPROTO_SCO){+.+.}-{0:0}:
    lock_acquire+0x1c4/0x520 sect/v6.13-rc4/kernel/locking/lockdep.c:5849 lock_sock_nested+0x48/0x130     sect/v6.13-rc4/net/core/sock.c:3622 lock_sock sect/v6.13-rc4/./include/net/sock.h:1623 [inline]     sco_sock_timeout+0xbe/0x270 sect/v6.13-rc4/net/bluetooth/sco.c:158 process_one_work     sect/v6.13-rc4/kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa99/0x18f0     sect/v6.13-rc4/kernel/workqueue.c:3310 worker_thread+0x8a9/0xd80 sect/v6.13-rc4/kernel/workqueue.c:3391     kthread+0x2c6/0x360 sect/v6.13-rc4/kernel/kthread.c:389 ret_from_fork+0x4e/0x80     sect/v6.13-rc4/arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30     sect/v6.13-rc4/arch/x86/entry/entry_64.S:244 -> #0     ((work_completion)(&(&conn->timeout_work)->work)){+.+.}-{0:0}: check_prev_add     sect/v6.13-rc4/kernel/locking/lockdep.c:3161 [inline] check_prevs_add     sect/v6.13-rc4/kernel/locking/lockdep.c:3280 [inline] validate_chain+0x1888/0x5760     sect/v6.13-rc4/kernel/locking/lockdep.c:3904 __lock_acquire+0x13b4/0x2120     sect/v6.13-rc4/kernel/locking/lockdep.c:5226 lock_acquire+0x1c4/0x520     sect/v6.13-rc4/kernel/locking/lockdep.c:5849 touch_work_lockdep_map sect/v6.13-rc4/kernel/workqueue.c:3909     [inline] start_flush_work sect/v6.13-rc4/kernel/workqueue.c:4163 [inline] __flush_work+0x70f/0xc40     sect/v6.13-rc4/kernel/workqueue.c:4195 __cancel_work_sync sect/v6.13-rc4/kernel/workqueue.c:4351 [inline]     disable_delayed_work_sync+0xbb/0xf0 sect/v6.13-rc4/kernel/workqueue.c:4514 sco_conn_free     sect/v6.13-rc4/net/bluetooth/sco.c:95 [inline] kref_put sect/v6.13-rc4/./include/linux/kref.h:65 [inline]     sco_conn_put+0x18f/0x270 sect/v6.13-rc4/net/bluetooth/sco.c:107 sco_chan_del+0xe2/0x210     sect/v6.13-rc4/net/bluetooth/sco.c:236 sco_sock_close+0x8f/0x100 sect/v6.13-rc4/net/bluetooth/sco.c:526     sco_sock_release+0x62/0x2d0 sect/v6.13-rc4/net/blueto ---truncated--- (CVE-2026-80666)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
341968	Linux Distros 未修補弱點：CVE-2026-80666	Nessus	Misc.	8/31/2026	9/1/2026	medium
341968	Linux Distros 未修补的漏洞：CVE-2026-80666	Nessus	Misc.	8/31/2026	9/1/2026	medium
341968	Linux Distros のパッチ未適用の脆弱性: CVE-2026-80666	Nessus	Misc.	8/31/2026	9/1/2026	medium
341968	Linux Distros Unpatched Vulnerability : CVE-2026-80666	Nessus	Misc.	8/31/2026	9/1/2026	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium