{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.11-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: RFCOMM: free the skb when the DLC has no owner  rfcomm_recv_data() hands the skb to d-\u003edata_ready() and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC has been detached from its device:    static void rfcomm_dev_data_ready(struct rfcomm_dlc *dlc,                                     struct sk_buff *skb)   {           struct rfcomm_dev *dev = dlc-\u003eowner;            if (!dev) {                   kfree_skb(skb);                   return;           }  The socket implementation returns without freeing it, and the skb is leaked.  A connected DLC can have no owner: rfcomm_sock_destruct() clears d-\u003eowner, while the DLC itself stays on the session until it is closed. Data frames that arrive in that window still find d-\u003estate == BT_CONNECTED in rfcomm_recv_data() and are handed to the callback, one leaked skb each.  The leak does not stop on its own either.  The remote runs out of credits only once RFCOMM_RX_THROTTLED is set, and for a socket the only place that sets it is rfcomm_sk_data_ready() itself, below the return. rfcomm_process_dlcs() keeps granting credits, so the remote keeps sending and the leak keeps growing.  Free the skb, as the tty side does.",
  "id": "DEBIAN-CVE-2026-99010",
  "modified": "2026-10-24T05:47:38.315274289Z",
  "published": "2026-10-23T13:17:23.620Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99010"
    }
  ],
  "upstream": [
    "CVE-2026-99010"
  ]
}