PT-2026-27664 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-05-29 · CVE-2026-23299

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Bluetooth component where Socket Buffer (SKB) structures may leak. When TX timestamping is enabled via SO TIMESTAMPING, SKBs can be queued into sk error queue and remain there until consumed. If the userspace fails to read the timestamps or if the controller is removed unexpectedly, these SKBs are not cleared, leading to a memory leak. The issue is addressed by implementing skb queue purge() calls for sk error queue within the affected bluetooth destructors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2026-23299

Affected Products

Linux Kernel

References · 18

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23299.json · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23299 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23299 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23299 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23299 · Vendor Advisory
• https://git.kernel.org/stable/c/21e4271e65094172aadd5beb8caea95dd0fbf6d7 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-23299 · Vendor Advisory
• https://git.kernel.org/stable/c/3de7c10a950b36affc692d8bd2ac713852580e56 · Patch
• https://ubuntu.com/security/CVE-2026-23299 · Vendor Advisory
• https://git.kernel.org/stable/c/2b6c942a526635f5c61d2f000258e620da32d3a7 · Patch
• https://twitter.com/dailycve/status/2060390932860543023 · Twitter Post
• https://twitter.com/CVEarity/status/2037930917562655167 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://t.me/cveNotify/165204 · Telegram Post