PT-2026-27664 · Linux · Linux

Published 2026-03-25 · Updated 2026-03-25 · CVE-2026-23299

NVD

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: purge error queues in socket destructors

When TX timestamping is enabled via SO TIMESTAMPING, SKBs may be queued into sk error queue and will stay there until consumed. If userspace never gets to read the timestamps, or if the controller is removed unexpectedly, these SKBs will leak.

Fix by adding skb queue purge() calls for sk error queue in affected bluetooth destructors. RFCOMM does not currently use sk error queue.

Related Identifiers

CVE-2026-23299

Affected Products

Linux

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-23299 · Security Note
• https://git.kernel.org/stable/c/3de7c10a950b36affc692d8bd2ac713852580e56 · Note
• https://git.kernel.org/stable/c/2b6c942a526635f5c61d2f000258e620da32d3a7 · Note
• https://git.kernel.org/stable/c/21e4271e65094172aadd5beb8caea95dd0fbf6d7 · Note