CVE-2026-23299 Linux kernel CVE debrief

Who should care

Linux system administrators and security teams should assess their exposure to this vulnerability and prioritize verifying the presence of the patches for the Linux kernel versions they are using.

Why it matters

A vulnerability in the Linux kernel's Bluetooth implementation could lead to SKB leaks when TX timestamping is enabled, requiring verification of patch presence and assessment of exposure.

• Verify patch presence for Linux kernel versions in use.
• Assess exposure to potential SKB leaks in Bluetooth implementation.
• Monitor system logs for exploitation attempts.

Technical summary

The Linux kernel's Bluetooth implementation has a vulnerability that could lead to SKB leaks when TX timestamping is enabled. The issue arises when SKBs are queued into sk_error_queue and remain there until consumed. If userspace fails to read the timestamps or the controller is unexpectedly removed, these SKBs will leak. The fix involves adding skb_queue_purge() calls for sk_error_queue in affected Bluetooth destructors.

Defensive priority

Linux system administrators and security teams should prioritize verifying the presence of the patches for the Linux kernel versions they are using and assess their exposure to this vulnerability.

Recommended defensive actions

• Verify the Linux kernel version and check if it is within the affected range.
• Apply the available patches for the affected Linux kernel versions.
• Monitor system logs for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, its impact, and the affected Linux kernel versions. Patches are available for the affected versions. Linux system administrators and security teams should verify the presence of patches for the Linux kernel versions they are using and assess their exposure to this vulnerability. The fix involves adding skb_queue_purge() calls for sk_error_queue in affected Bluetooth destructors. Evidence limits suggest that defenders should verify patch presence and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.