CVE-2026-99010
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC has been detached from its device: static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb) { struct rfcomm_dev *dev = dlc->owner; if (!dev) { kfree_skb(skb); return; } The socket implementation returns without freeing it, and the skb is leaked. A connected DLC can have no owner: rfcomm_sock_destruct() clears d->owner, while the DLC itself stays on the session until it is closed. Data frames that arrive in that window still find d->state == BT_CONNECTED in rfcomm_recv_data() and are handed to the callback, one leaked skb each. The leak does not stop on its own either. The remote runs out of credits only once RFCOMM_RX_THROTTLED is set, and for a socket the only place that sets it is rfcomm_sk_data_ready() itself, below the return. rfcomm_process_dlcs() keeps granting credits, so the remote keeps sending and the leak keeps growing. Free the skb, as the tty side does.
Severity
Not scored
CVSS score
Not available
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-10-23 13:17:23.620000
Last modified
2026-10-30 13:21:36.900000
View original CVE JSON
{
"id": "CVE-2026-99010",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-10-23T13:17:23.620",
"lastModified": "2026-10-30T13:21:36.900",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: RFCOMM: free the skb when the DLC has no owner\n\nrfcomm_recv_data() hands the skb to d->data_ready() and returns 0\nwithout freeing it, so the callback owns the skb from that point on.\nThe tty implementation frees it when the DLC has been detached from its\ndevice:\n\n static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc,\n struct sk_buff *skb)\n {\n struct rfcomm_dev *dev = dlc->owner;\n\n if (!dev) {\n kfree_skb(skb);\n return;\n }\n\nThe socket implementation returns without freeing it, and the skb is\nleaked.\n\nA connected DLC can have no owner: rfcomm_sock_destruct() clears\nd->owner, while the DLC itself stays on the session until it is closed.\nData frames that arrive in that window still find d->state ==\nBT_CONNECTED in rfcomm_recv_data() and are handed to the callback, one\nleaked skb each.\n\nThe leak does not stop on its own either. The remote runs out of\ncredits only once RFCOMM_RX_THROTTLED is set, and for a socket the only\nplace that sets it is rfcomm_sk_data_ready() itself, below the return.\nrfcomm_process_dlcs() keeps granting credits, so the remote keeps\nsending and the leak keeps growing.\n\nFree the skb, as the tty side does."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"net/bluetooth/rfcomm/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "05145638e0db770267c39615c8ce51ab058e34cf",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "91492e9194f3b10bc1eb50683ac440b74a487e39",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "a835b7f445427c7bdfc7169a97e0a1bec375e408",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "c3f76b025cbbb0ab47310dbe7de18092d89f2a99",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "4f46de658ce61968aef5ea7ae809d1c180330544",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "b8814161b14c610b7a09527433301d8ad8180aef",
"versionType": "git",
"status": "affected"
},
{
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"lessThan": "9d1afbf60ed53c5b051cd124153e0ae3078c8b93",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"net/bluetooth/rfcomm/sock.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "2.6.12",
"status": "affected"
},
{
"version": "0",
"lessThan": "2.6.12",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.191",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.160",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.113",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.57",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.11",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {},
"references": [
{
"url": "https://git.kernel.org/stable/c/05145638e0db770267c39615c8ce51ab058e34cf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4f46de658ce61968aef5ea7ae809d1c180330544",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/91492e9194f3b10bc1eb50683ac440b74a487e39",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/9d1afbf60ed53c5b051cd124153e0ae3078c8b93",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a835b7f445427c7bdfc7169a97e0a1bec375e408",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/b8814161b14c610b7a09527433301d8ad8180aef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c3f76b025cbbb0ab47310dbe7de18092d89f2a99",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}