CVE-2026-99010 - Vulnerability Details

- Bluetooth: RFCOMM: free the skb when the DLC has no owner

Description

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: free the skb when the DLC has no owner

rfcomm_recv_data() hands the skb to d->data_ready() and returns 0
without freeing it, so the callback owns the skb from that point on.
The tty implementation frees it when the DLC has been detached from its
device:

static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc,
struct sk_buff *skb)
{
struct rfcomm_dev *dev = dlc->owner;

if (!dev) {
kfree_skb(skb);
return;
}

The socket implementation returns without freeing it, and the skb is
leaked.

A connected DLC can have no owner: rfcomm_sock_destruct() clears
d->owner, while the DLC itself stays on the session until it is closed.
Data frames that arrive in that window still find d->state ==
BT_CONNECTED in rfcomm_recv_data() and are handed to the callback, one
leaked skb each.

The leak does not stop on its own either. The remote runs out of
credits only once RFCOMM_RX_THROTTLED is set, and for a socket the only
place that sets it is rfcomm_sk_data_ready() itself, below the return.
rfcomm_process_dlcs() keeps granting credits, so the remote keeps
sending and the leak keeps growing.

Free the skb, as the tty side does.

Published: 2026-10-23

Score: 5.3 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug resides in the Linux kernel’s Bluetooth RFCOMM subsystem, where incoming data frames are handed off to a callback without freeing the socket buffer (skb) when the data link connection (DLC) has no owner. Each unfreed skb consumes memory and the leak grows as the remote side continues to send data. Over time this can exhaust system memory, potentially causing an application or kernel crash and degrading overall system performance, which effectively results in a denial‑of‑service condition.

Affected Systems

All Linux distributions running a kernel that includes the earlier RFCOMM driver before the commit that implements the skb free are vulnerable. This includes any kernel version where the Bluetooth RFCOMM code has not yet applied the fix, regardless of vendor‑specific version numbers.

Risk and Exploitability

The CVSS score of 5.3 denotes medium severity while the EPSS score of <1% indicates a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker establishing a Bluetooth RFCOMM connection to the target device and transmitting a large volume of data while the DLC remains unowned; this does not require elevated privileges. If successful, the continuous memory leak can accumulate to the point of exhausting available RAM, resulting in service disruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 05145638e0db770267c39615c8ce51ab058e34cf
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 91492e9194f3b10bc1eb50683ac440b74a487e39
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a835b7f445427c7bdfc7169a97e0a1bec375e408
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< c3f76b025cbbb0ab47310dbe7de18092d89f2a99
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 4f46de658ce61968aef5ea7ae809d1c180330544
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b8814161b14c610b7a09527433301d8ad8180aef
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 9d1afbf60ed53c5b051cd124153e0ae3078c8b93

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.113`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c3f76b025cbbb0ab47310dbe7de18092d89f2a99)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4f46de658ce61968aef5ea7ae809d1c180330544)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b8814161b14c610b7a09527433301d8ad8180aef)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9d1afbf60ed53c5b051cd124153e0ae3078c8b93)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,c3f76b025cbbb0ab47310dbe7de18092d89f2a99)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,4f46de658ce61968aef5ea7ae809d1c180330544)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b8814161b14c610b7a09527433301d8ad8180aef)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,9d1afbf60ed53c5b051cd124153e0ae3078c8b93)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.6.160,6.7.0)`	unaffected	semver	—
`[6.12.113,6.13.0)`	unaffected	semver	—
`[6.18.57,6.19.0)`	unaffected	semver	—
`[7.2.11,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel patch that frees the skb when the DLC has no owner, as referenced in the advisory and associated commit logs.
If the patch is not yet available for your distribution, disable RFCOMM or block all Bluetooth traffic at a lower layer until the kernel is updated.
Monitor system memory usage for abnormal growth in skb allocations and configure alerts for memory thresholds to detect potential exploitation early.

Generated by OpenCVE AI on October 29, 2026 at 21:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00177.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99010.mbox
https://git.kernel.org/stable/c/05145638e0db770267c39615c8ce51ab058e34cf
https://git.kernel.org/stable/c/4f46de658ce61968aef5ea7ae809d1c180330544
https://git.kernel.org/stable/c/91492e9194f3b10bc1eb50683ac440b74a487e39
https://git.kernel.org/stable/c/9d1afbf60ed53c5b051cd124153e0ae3078c8b93
https://git.kernel.org/stable/c/a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9
https://git.kernel.org/stable/c/a835b7f445427c7bdfc7169a97e0a1bec375e408
https://git.kernel.org/stable/c/b8814161b14c610b7a09527433301d8ad8180aef
https://git.kernel.org/stable/c/c3f76b025cbbb0ab47310dbe7de18092d89f2a99
https://nvd.nist.gov/vuln/detail/CVE-2026-99010
https://www.cve.org/CVERecord?id=CVE-2026-99010

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/05145638e0db770267c39615c8ce51ab058e34cf https://git.kernel.org/stable/c/91492e9194f3b10bc1eb50683ac440b74a487e39 https://git.kernel.org/stable/c/a835b7f445427c7bdfc7169a97e0a1bec375e408

Thu, 29 Oct 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99010.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99010 https://www.cve.org/CVERecord?id=CVE-2026-99010
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 24 Oct 2026 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC has been detached from its device: static void rfcomm_dev_data_ready(struct rfcomm_dlc dlc, struct sk_buff skb) { struct rfcomm_dev *dev = dlc->owner; if (!dev) { kfree_skb(skb); return; } The socket implementation returns without freeing it, and the skb is leaked. A connected DLC can have no owner: rfcomm_sock_destruct() clears d->owner, while the DLC itself stays on the session until it is closed. Data frames that arrive in that window still find d->state == BT_CONNECTED in rfcomm_recv_data() and are handed to the callback, one leaked skb each. The leak does not stop on its own either. The remote runs out of credits only once RFCOMM_RX_THROTTLED is set, and for a socket the only place that sets it is rfcomm_sk_data_ready() itself, below the return. rfcomm_process_dlcs() keeps granting credits, so the remote keeps sending and the leak keeps growing. Free the skb, as the tty side does.
Title		Bluetooth: RFCOMM: free the skb when the DLC has no owner
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4f46de658ce61968aef5ea7ae809d1c180330544 https://git.kernel.org/stable/c/9d1afbf60ed53c5b051cd124153e0ae3078c8b93 https://git.kernel.org/stable/c/a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9 https://git.kernel.org/stable/c/b8814161b14c610b7a09527433301d8ad8180aef https://git.kernel.org/stable/c/c3f76b025cbbb0ab47310dbe7de18092d89f2a99

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:20:35.485Z

Updated: 2026-10-30T12:40:55.508Z

Reserved: 2026-09-25T10:25:14.385Z

Link: CVE-2026-99010

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:23.620

Modified: 2026-10-30T13:21:36.900

Link: CVE-2026-99010

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99010 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T21:30:15Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object