CVE-2026-99026: net: team: free skb when broadcast has no txable port

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: team: free skb when broadcast has no txable port

bctransmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit() still returns NETDEVTXOK. AFPACKET sends then retain the skb and its socket write-memory charge.

A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact.

Discovered by Sashiko during review of previous commit.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·12:21 PM

Data Sourced

via MITRE·12:21 PM

Description

Frequently Asked Questions

What conditions are required for the issue to occur?

The team device must use the broadcast transmit operation and have no TX-capable port available. One described scenario is a TX-enabled but link-down port, while carrier remains up through another link-up port that is TX-disabled or because userspace forces carrier on.

What traffic path is affected?

The described impact occurs with AF_PACKET sends. When the team broadcast path has no TX-capable port, the skb is not consumed even though the transmit operation reports NETDEV_TX_OK, causing the skb and its socket write-memory charge to be retained.

How can systems be mitigated before applying the fix?

Avoid operating a team interface in broadcast mode with carrier up while no member port is TX-capable. In particular, correct member-port link and TX-enable states and avoid forcing carrier on in that condition.

How can an administrator determine whether a system is exposed?

Review team configurations for the broadcast transmit operation and check whether they can present carrier as up despite having no TX-capable ports. Systems that use AF_PACKET traffic in this state match the affected path described.

CVE-2026-99026: net: team: free skb when broadcast has no txable port

Affected Software

Event History

Frequently Asked Questions

What conditions are required for the issue to occur?

What traffic path is affected?

How can systems be mitigated before applying the fix?

How can an administrator determine whether a system is exposed?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for the issue to occur?

What traffic path is affected?

How can systems be mitigated before applying the fix?

How can an administrator determine whether a system is exposed?