CVE-2026-23299

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23299", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.993Z", "datePublished": "2026-03-25T10:26:55.481Z", "dateUpdated": "2026-11-05T21:33:36.789Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:04:11.865Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: purge error queues in socket destructors\n\nWhen TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued\ninto sk_error_queue and will stay there until consumed. If userspace never\ngets to read the timestamps, or if the controller is removed unexpectedly,\nthese SKBs will leak.\n\nFix by adding skb_queue_purge() calls for sk_error_queue in affected\nbluetooth destructors. RFCOMM does not currently use sk_error_queue."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_sock.c", "net/bluetooth/iso.c", "net/bluetooth/l2cap_sock.c", "net/bluetooth/sco.c"], "versions": [{"version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "lessThan": "2b6c942a526635f5c61d2f000258e620da32d3a7", "status": "affected", "versionType": "git"}, {"version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "lessThan": "3de7c10a950b36affc692d8bd2ac713852580e56", "status": "affected", "versionType": "git"}, {"version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "lessThan": "21e4271e65094172aadd5beb8caea95dd0fbf6d7", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bluetooth/hci_sock.c", "net/bluetooth/iso.c", "net/bluetooth/l2cap_sock.c", "net/bluetooth/sco.c"], "versions": [{"version": "6.15", "status": "affected"}, {"version": "0", "lessThan": "6.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.15", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2b6c942a526635f5c61d2f000258e620da32d3a7"}, {"url": "https://git.kernel.org/stable/c/3de7c10a950b36affc692d8bd2ac713852580e56"}, {"url": "https://git.kernel.org/stable/c/21e4271e65094172aadd5beb8caea95dd0fbf6d7"}], "title": "Bluetooth: purge error queues in socket destructors", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23299", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:25:59.052559Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:36.789Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23299", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:25:59.052559Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:25:59.969Z"}}], "cna": {"title": "Bluetooth: purge error queues in socket destructors", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "lessThan": "2b6c942a526635f5c61d2f000258e620da32d3a7", "versionType": "git"}, {"status": "affected", "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "lessThan": "3de7c10a950b36affc692d8bd2ac713852580e56", "versionType": "git"}, {"status": "affected", "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "lessThan": "21e4271e65094172aadd5beb8caea95dd0fbf6d7", "versionType": "git"}], "programFiles": ["net/bluetooth/hci_sock.c", "net/bluetooth/iso.c", "net/bluetooth/l2cap_sock.c", "net/bluetooth/sco.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"status": "unaffected", "version": "0", "lessThan": "6.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.17", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.7", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bluetooth/hci_sock.c", "net/bluetooth/iso.c", "net/bluetooth/l2cap_sock.c", "net/bluetooth/sco.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/2b6c942a526635f5c61d2f000258e620da32d3a7"}, {"url": "https://git.kernel.org/stable/c/3de7c10a950b36affc692d8bd2ac713852580e56"}, {"url": "https://git.kernel.org/stable/c/21e4271e65094172aadd5beb8caea95dd0fbf6d7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: purge error queues in socket destructors\n\nWhen TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued\ninto sk_error_queue and will stay there until consumed. If userspace never\ngets to read the timestamps, or if the controller is removed unexpectedly,\nthese SKBs will leak.\n\nFix by adding skb_queue_purge() calls for sk_error_queue in affected\nbluetooth destructors. RFCOMM does not currently use sk_error_queue."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.15"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:04:11.865Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23299", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:36.789Z", "dateReserved": "2026-01-13T15:37:45.993Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-03-25T10:26:55.481Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bluetooth/hci_sock.c", "net/bluetooth/iso.c", "net/bluetooth/l2cap_sock.c", "net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2b6c942a526635f5c61d2f000258e620da32d3a7", "status": "affected", "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "versionType": "git"}, {"lessThan": "3de7c10a950b36affc692d8bd2ac713852580e56", "status": "affected", "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "versionType": "git"}, {"lessThan": "21e4271e65094172aadd5beb8caea95dd0fbf6d7", "status": "affected", "version": "134f4b39df7b77225a80ef585c15d46f964f5e6f", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bluetooth/hci_sock.c", "net/bluetooth/iso.c", "net/bluetooth/l2cap_sock.c", "net/bluetooth/sco.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.15"}, {"lessThan": "6.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.17", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7B6E9607-896D-4A84-B5CB-3311EB1230BD", "versionEndExcluding": "6.18.17", "versionStartIncluding": "6.15", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "69245D10-0B71-485E-80C3-A64F077004D3", "versionEndExcluding": "6.19.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nBluetooth: purge error queues in socket destructors\n\nWhen TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued\ninto sk_error_queue and will stay there until consumed. If userspace never\ngets to read the timestamps, or if the controller is removed unexpectedly,\nthese SKBs will leak.\n\nFix by adding skb_queue_purge() calls for sk_error_queue in affected\nbluetooth destructors. RFCOMM does not currently use sk_error_queue."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nBluetooth: purgar colas de error en destructores de sockets\n\nCuando la marca de tiempo TX est\u00e1 habilitada a trav\u00e9s de SO_TIMESTAMPING, los SKB pueden ser encolados en sk_error_queue y permanecer\u00e1n all\u00ed hasta ser consumidos. Si el espacio de usuario nunca llega a leer las marcas de tiempo, o si el controlador es eliminado inesperadamente, estos SKB se filtrar\u00e1n.\n\nSoluci\u00f3n a\u00f1adiendo llamadas a skb_queue_purge() para sk_error_queue en los destructores de bluetooth afectados. RFCOMM no utiliza actualmente sk_error_queue."}], "id": "CVE-2026-23299", "lastModified": "2026-11-05T22:18:12.920", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23299", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:25:59.052559Z", "version": "2.0.3"}}]}, "published": "2026-03-25T11:16:25.487", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/21e4271e65094172aadd5beb8caea95dd0fbf6d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2b6c942a526635f5c61d2f000258e620da32d3a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3de7c10a950b36affc692d8bd2ac713852580e56"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-772"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: Bluetooth: purge error queues in socket destructors", "id": "2451204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451204"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's Bluetooth subsystem. When transmit (TX) timestamping is enabled, socket kernel buffers (SKBs) can accumulate in an error queue. If user applications fail to read these timestamps or if the Bluetooth controller is unexpectedly removed, these SKBs are not properly released. This oversight leads to a memory leak, which can degrade system performance or cause a denial of service (DoS)."], "name": "CVE-2026-23299", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23299\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23299\nhttps://lore.kernel.org/linux-cve-announce/2026032526-CVE-2026-23299-6471@gregkh/T"], "statement": "This flaw affects systems using Bluetooth with SO_TIMESTAMPING enabled for TX timestamps. The memory leak occurs when SKBs queued in sk_error_queue are not consumed before socket destruction or controller removal. The impact is gradual memory exhaustion rather than an immediate crash. RFCOMM sockets are not affected.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[134f4b39df7b77225a80ef585c15d46f964f5e6f,2b6c942a526635f5c61d2f000258e620da32d3a7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[134f4b39df7b77225a80ef585c15d46f964f5e6f,3de7c10a950b36affc692d8bd2ac713852580e56)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[134f4b39df7b77225a80ef585c15d46f964f5e6f,21e4271e65094172aadd5beb8caea95dd0fbf6d7)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.15"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.15)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-03-26T14:05:34.960287+00:00", "value": {"mitigation_remediation": ["Apply a Linux kernel update that includes the skb_queue_purge fix for Bluetooth socket destructors", "If an immediate kernel update is not available, consider disabling SO_TIMESTAMPING in applications that use Bluetooth sockets to reduce the accumulation of error queue entries", "Restart the machine to clear any stale sk_error_queue entries while a patch is pending"], "summary": {"action": "Apply Patch", "impact": "Potential kernel memory exhaustion and DoS via unpurged socket error queues"}, "threat_synthesis": {"affected_systems": "The issue affects the Linux kernel\u2019s Bluetooth implementation. All distributions running a kernel build that contains the buggy Bluetooth socket destructors and that enable SO_TIMESTAMPING are potentially impacted. The specific kernel versions are not listed in the advisory, so administrators should check whether their kernel series includes this change as part of recent updates.", "description_and_impact": "The defect resides in the Linux Bluetooth subsystem, where transmit timestamping enables sk_buff instances to be queued into sk_error_queue. The kernel fails to clear this queue during socket cleanup, so the queued sk_buffs persist until the user processes the timestamps or until the Bluetooth controller is disconnected. Because the items remain in memory, repeated creation and destruction of Bluetooth sockets can consume kernel memory, potentially exhausting the system and resulting in a denial of service. This weakness is a classic resource\u2011leak scenario (CWE\u2011772).", "risk_and_exploitability": "The packaged CVSS score is 5.5, reflecting a moderate impact and requiring operators or local users to invoke Bluetooth socket operations. The EPSS score of less than 1% suggests that exploitation is unlikely at present, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a user or application that repeatedly opens and closes Bluetooth sockets with timestamping enabled, eventually exhausting kernel memory. Because the flaw is a kernel resource leak rather than an immediate privilege\u2011escalation flaw, it is generally mitigated by applying the kernel patch before a DoS occurs."}}}}, "created": "2026-03-25T21:15:31.405386+00:00", "updated": "2026-03-27T09:50:07.269802+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}