---
id: CVE-2026-23299
title: 'Bluetooth: purge error queues in socket destructors'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  Bluetooth: purge error queues in socket destructors

  When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued
  into sk_error_queue and will stay there unt…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 134f4b39df7b77225a80ef585c15d46f964f5e6f <
    2b6c942a526635f5c61d2f000258e620da32d3a7
  - >-
    Linux >= 134f4b39df7b77225a80ef585c15d46f964f5e6f <
    3de7c10a950b36affc692d8bd2ac713852580e56
  - >-
    Linux >= 134f4b39df7b77225a80ef585c15d46f964f5e6f <
    21e4271e65094172aadd5beb8caea95dd0fbf6d7
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:25:59.052559Z'
published: '2026-03-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:36.789Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23299'
references:
  - url: 'https://git.kernel.org/stable/c/2b6c942a526635f5c61d2f000258e620da32d3a7'
  - url: 'https://git.kernel.org/stable/c/3de7c10a950b36affc692d8bd2ac713852580e56'
  - url: 'https://git.kernel.org/stable/c/21e4271e65094172aadd5beb8caea95dd0fbf6d7'
tags:
  - cve.org
epss: 0.00125
epssPercentile: 0.02251
ingestedAt: '2026-11-05T22:38:32.115Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: purge error queues in socket destructors

When TX timestamping is enabled via SO_TIMESTAMPING, SKBs may be queued
into sk_error_queue and will stay there until consumed. If userspace never
gets to read the timestamps, or if the controller is removed unexpectedly,
these SKBs will leak.

Fix by adding skb_queue_purge() calls for sk_error_queue in affected
bluetooth destructors. RFCOMM does not currently use sk_error_queue.

## Affected

- `Linux >= 134f4b39df7b77225a80ef585c15d46f964f5e6f < 2b6c942a526635f5c61d2f000258e620da32d3a7`
- `Linux >= 134f4b39df7b77225a80ef585c15d46f964f5e6f < 3de7c10a950b36affc692d8bd2ac713852580e56`
- `Linux >= 134f4b39df7b77225a80ef585c15d46f964f5e6f < 21e4271e65094172aadd5beb8caea95dd0fbf6d7`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.