CVE-2026-99010
kernel: Bluetooth: RFCOMM: free the skb when the DLC has no owner
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · October 23, 2026
Updated · October 29, 2026
Description
A flaw was found in the Linux kernel's Bluetooth Radio Frequency Communication (RFCOMM) subsystem. When a communication socket is closed while the underlying connection session remains active, incoming data packets are not released from memory. A remote attacker can exploit this vulnerability by continuously transmitting data during socket teardown, causing an unbounded memory leak that results in kernel resource exhaustion and a Denial of Service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime