CVE-2026-99010

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: RFCOMM: free the skb when the DLC has no owner

rfcomm recv data() hands the skb to d->data ready() and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC has been detached from its device:

static void rfcomm dev data ready(struct rfcomm dlc *dlc, struct sk buff *skb) { struct rfcomm dev *dev = dlc->owner;

 if (!dev) {
     kfree skb(skb);
     return;
 }

The socket implementation returns without freeing it, and the skb is leaked.

A connected DLC can have no owner: rfcomm sock destruct() clears d->owner, while the DLC itself stays on the session until it is closed. Data frames that arrive in that window still find d->state == BT CONNECTED in rfcomm recv data() and are handed to the callback, one leaked skb each.

The leak does not stop on its own either. The remote runs out of credits only once RFCOMM RX THROTTLED is set, and for a socket the only place that sets it is rfcomm sk data ready() itself, below the return. rfcomm process dlcs() keeps granting credits, so the remote keeps sending and the leak keeps growing.

Free the skb, as the tty side does.