Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99010— Bluetooth: RFCOMM: free the skb when the DLC has no owner

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： 蓝牙：RFCOMM：当 DLC 没有所有者时释放 skb 函数将 （套接字缓冲区）传递给 回调，并返回 0，此时并未释放该 。因此，从该点起， 的所有权归属于回调函数。 在 TTY 实现中，当 DLC 从其设备断开时，会释放该 ： 然而，套接字（socket）实现中并未在返回前释放 ，导致 发生内存泄漏。 一个已连接的 DLC 可能没有所有者： 会清除 ，但 DLC 本身在会话关闭之前仍保留在会话中。在此时间窗口内到达的数据帧，在 中仍会检测到 ，从而被传递给回调函数，

AI Predicted 5.5 Difficulty: Moderate EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< c3f76b025cbbb0ab47310dbe7de18092d89f2a99 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 4f46de658ce61968aef5ea7ae809d1c180330544 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< b8814161b14c610b7a09527433301d8ad8180aef affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 9d1afbf60ed53c5b051cd124153e0ae3078c8b93 affected
2.6.12 affected
< 2.6.12 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99010

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Bluetooth: RFCOMM: free the skb when the DLC has no owner
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data() hands the skb to d->data_ready() and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC has been detached from its device: static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc, struct sk_buff *skb) { struct rfcomm_dev *dev = dlc->owner; if (!dev) { kfree_skb(skb); return; } The socket implementation returns without freeing it, and the skb is leaked. A connected DLC can have no owner: rfcomm_sock_destruct() clears d->owner, while the DLC itself stays on the session until it is closed. Data frames that arrive in that window still find d->state == BT_CONNECTED in rfcomm_recv_data() and are handed to the callback, one leaked skb each. The leak does not stop on its own either. The remote runs out of credits only once RFCOMM_RX_THROTTLED is set, and for a socket the only place that sets it is rfcomm_sk_data_ready() itself, below the return. rfcomm_process_dlcs() keeps granting credits, so the remote keeps sending and the leak keeps growing. Free the skb, as the tty side does.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ a54ce160e3ef7e50ec94e0ac4131c3d0f9f739b9 -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2026-99010

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99010

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99010 (5)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-98993 7.8 HIGH namespace: don't inherit MNT_UMOUNT in clone_mnt()
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99056 7.8 HIGH strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-99002 7.8 HIGH drm/vmwgfx: validate pitch coming from userspace
CVE-2026-98899 7.8 HIGH netfilter: ipset: mark the rcu locked areas properly
CVE-2026-99014 7.8 HIGH Bluetooth: hci_sync: Fix command skb lifetime during scan setup

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux