CVE-2026-99026 net: team: free skb when broadcast has no txable port
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99026?
CVE-2026-99026 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: team: free skb when broadcast has no txable port
bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the skb and its socket write-memory charge.
A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact.
Discovered by Sashiko during review of previous commit.
Which versions are affected by CVE-2026-99026?
How do I fix CVE-2026-99026?
Upgrade to a fixed version.
Is CVE-2026-99026 being exploited?
There is no known exploitation of CVE-2026-99026 in the wild and no public exploit code.
Sources
Also known as AZL-110882, BELL-CVE-2026-99026, DEBIAN-CVE-2026-99026, GHSA-c6m3-gh7v-93hm, UBUNTU-CVE-2026-99026.