CVE-2026-23299: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23299 is a memory leak vulnerability in the Linux kernel's Bluetooth subsystem, specifically in socket destructors when TX timestamping is enabled via SO_TIMESTAMPING. When Socket Buffers (SKBs) are queued into sk_error_queue and userspace never reads the timestamps — or if the Bluetooth controller is unexpectedly removed — these SKBs are never freed, causing kernel memory exhaustion. Affected Linux kernel versions include 6.15 through 6.18.16 and 6.19 through 6.19.6. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). When SO_TIMESTAMPING is enabled on Bluetooth sockets, the kernel queues TX timestamp SKBs into sk_error_queue. The Bluetooth socket destructors (excluding RFCOMM, which does not use sk_error_queue) failed to call skb_queue_purge() on this queue during socket teardown, resulting in a kernel memory leak. The fix adds explicit skb_queue_purge() calls for sk_error_queue in the affected Bluetooth socket destructors (Red Hat Bugzilla, Kernel Patch 1).

A local user with socket creation permissions can exploit this vulnerability to cause unbounded kernel memory exhaustion, leading to degraded system performance or a system crash (denial of service). The vulnerability has no confidentiality or integrity impact; only availability is affected. The attack is limited to the local system and does not facilitate lateral movement or data exfiltration (Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires local access and the ability to create Bluetooth sockets (Red Hat Advisory).

Update the Linux kernel to a patched version: 6.18.17 or later (for the 6.15–6.18 branch), 6.19.7 or later (for the 6.19 branch), or 7.0-rc2 or later. Patches are available in the Linux kernel stable branches via the upstream commits. If immediate patching is not feasible, restrict Bluetooth socket creation permissions to trusted users only, or disable Bluetooth functionality if it is not required on the affected system (Red Hat Advisory, Kernel Patch 1).