All vulnerabilities
CVE-2026-99026

Linux: net: team: free skb when broadcast has no txable port

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in961563117626f4681623077ec0cfd86f86da0d49Also 489114c9ecae44e523361a4b3e610ee5ebd9189cCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 961563117626f4681623077ec0cfd86f86da0d49LinuxCVE List
  • 489114c9ecae44e523361a4b3e610ee5ebd9189cLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net: team: free skb when broadcast has no txable port

bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the skb and its socket write-memory charge.

A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact.

Discovered by Sashiko during review of previous commit.

Text from CVE List

Affected versions 8

  • Linuxaffected: 5fc889911a99043a97da1daa0d010ad72cbc3042 before 961563117626f4681623077ec0cfd86f86da0d49CVE List
  • Linuxaffected: 5fc889911a99043a97da1daa0d010ad72cbc3042 before f34b1bcac4581a5bd3daf9eff90f175e736b54aaCVE List
  • Linuxaffected: 5fc889911a99043a97da1daa0d010ad72cbc3042 before 489114c9ecae44e523361a4b3e610ee5ebd9189cCVE List
  • Linuxaffected: 3.6CVE List
  • Linuxunaffected: all versions before 3.6CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3