CVE-2026-99027: net: team: stop reusing skb after queue override

Published Oct 23, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: team: stop reusing skb after queue override

A nonzero devqueuexmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb.

Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting.

BUG: KASAN: slab-use-after-free in skskbreasondrop Write of size 4 by task poc/5040 skskbreasondrop (net/core/skbuff.c:1240) devkfreeskbanyreason (net/core/dev.c:3470) abtransmit (drivers/net/team/teammodeactivebackup.c:49) teamxmit (drivers/net/team/teamcore.c:1849) devdirectxmit (net/core/dev.c:4934) Freed by task 5040: tcfkfreeskblist (net/sched/schgeneric.c:43) devqueuexmit (net/core/dev.c:4831) teamxmit (drivers/net/team/teamcore.c:1846) Kernel panic - not syncing: KASAN: paniconwarn set ...

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 23, 2026

CVE Published

via MITRE·12:21 PM

Data Sourced

via MITRE·12:21 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Linux kernel team driver can be exposed when transmission uses an override port and that port's qdisc drops the packet. The affected path is in team interface transmit handling.

What conditions trigger the use-after-free?

The condition occurs when dev_queue_xmit() returns a nonzero result after the qdisc has dropped and freed the skb. The team queue-override logic then attempts another port or the mode transmit operation using that freed skb.

How might an affected system present?

A KASAN-enabled kernel can report a slab-use-after-free in sk_skb_reason_drop, with stack frames including dev_kfree_skb_any_reason, ab_transmit, and team_xmit. With panic_on_warn enabled, the report can result in a kernel panic.

CVE-2026-99027: net: team: stop reusing skb after queue override

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions trigger the use-after-free?

How might an affected system present?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What conditions trigger the use-after-free?

How might an affected system present?