In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcomm_recv_data()… (CVE-2026-99010)

The Linux kernel Bluetooth RFCOMM code in rfcomm_recv_data() hands the skb to a callback and returns without freeing it, transferring ownership. When the DLC has no owner (cleared by rfcomm_sock_destruct()), incoming data frames still trigger the callback, but the socket implementation does not free the skb, causing a memory leak. The leak persists because the remote device continues sending data due to credits being granted continuously by rfcomm_process_dlcs(). The fix involves freeing the skb when the DLC has no owner, similar to the tty implementation.

This vulnerability causes a memory leak in the Linux kernel Bluetooth RFCOMM socket implementation. Over time, this can lead to resource exhaustion on the affected system, potentially degrading system performance or causing denial of service due to memory depletion. There is no indication of direct code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, monitoring for unusual memory consumption related to Bluetooth RFCOMM sockets may help detect exploitation attempts. No vendor advisory or patch link is provided in the input data.