CVE-2026-23299
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: purge error queues in socket destructors When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued into sk_error_queue and will stay there until consumed. If userspace never gets to read the timestamps, or if the controller is removed unexpectedly, these SKBs will leak. Fix by adding skb_queue_purge() calls for sk_error_queue in affected bluetooth destructors. RFCOMM does not currently use sk_error_queue.
SeverityMedium
CVSS5.5
Exploit probability—
Product
Linux Kernel
PublishedMar 25, 2026
First seenMar 25, 2026
Weakness typeCWE-772CWE-772
How to fix
Update
- linux linux_kernel6.18.17, 6.19.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 6.15 ≤ v < 6.18.17, 6.19 ≤ v < 6.19.7, 7.0 | 6.18.17, 6.19.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.