Is CVE-2026-99010 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-99010 being exploited in the wild.

How severe is CVE-2026-99010?

Informational severity, published 23 October 2026.

Which products and versions are affected?

Linux kernel Since Linux 2.6.12-rc2 (Fixes: 1da177e4c3f4).

Is there a fix for CVE-2026-99010?

A patch was published on 2026-09-28: Upstream patch merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-99010 attacked?

It is attacked over the network or from the adjacent network, in an operating system.

Am I affected by CVE-2026-99010?

Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-99010: Linux kernel Bluetooth RFCOMM memory leak in socket callback

CVE-2026-99010 · Severity: info · Published 2026-10-23

The Linux kernel's Bluetooth RFCOMM subsystem leaks memory when socket-based connections receive data after the socket is detached. An attacker on the network can send repeated Bluetooth RFCOMM frames to trigger continuous memory allocation without release, eventually exhausting system memory and causing a denial of service.

Technologies: Linux kernel.

Quick answers

Is CVE-2026-99010 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-99010 being exploited in the wild.
How severe is CVE-2026-99010?: Informational severity, published 23 October 2026.
Which products and versions are affected?: Linux kernel Since Linux 2.6.12-rc2 (Fixes: 1da177e4c3f4).
Is there a fix for CVE-2026-99010?: A patch was published on 2026-09-28: Upstream patch merged Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-99010 attacked?: It is attacked over the network or from the adjacent network, in an operating system.
Am I affected by CVE-2026-99010?: Check whether you run Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A memory leak occurs in rfcomm_sk_data_ready() when a DLC (Logical Link Connection) has no owner after rfcomm_sock_destruct() clears the ownership but the connection remains active. Incoming data frames trigger the callback without freeing the sk_buff, and the flow control mechanism fails to stop the remote from sending more data, causing unbounded memory growth. The vulnerability is in net/bluetooth/rfcomm/sock.c and requires a connected Bluetooth RFCOMM socket to be present.

Affected products

Linux kernel Since Linux 2.6.12-rc2 (Fixes: 1da177e4c3f4)

Timeline

2026-10-23: disclosed
2026-09-28: patched: Upstream patch merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.