Description: UAF in sco_send_frame function References: https://www.openwall.com/lists/oss-security/2021/07/22/1 https://bugzilla.suse.com/show_bug.cgi?id=1188172 https://x-lore.kernel.org/all/883dc4b7-d1a1-3d31-a5a8-8fa1791084b6@i-love.sakura.ne.jp/ Notes: carnil> Prerequisites before the "last piece for fixing CVE-2021-3640" carnil> are e04480920d1e ("Bluetooth: defer cleanup of resources in carnil> hci_unregister_dev()") and 734bc5ff7831 ("Bluetooth: avoid carnil> circular locks in sco_sock_connect"), ba316be1b6a0 ("Bluetooth: carnil> schedule SCO timeouts with delayed_work"), 27c24fda62b6 carnil> ("Bluetooth: switch to lock_sock in SCO") Bugs: upstream: needed 5.10-upstream-stable: 4.19-upstream-stable: 4.9-upstream-stable: sid: 4.19-buster-security: 4.9-stretch-security: