CVE-2026-99027 - Vulnerability Details

- net: team: stop reusing skb after queue override

Description

In the Linux kernel, the following vulnerability has been resolved:

net: team: stop reusing skb after queue override

A nonzero dev_queue_xmit() result does not return ownership of the skb.
When an override port's qdisc drops it, the queue override helper used to
try another port or the mode transmit op with the freed skb.

Return the handoff decision separately from transmit success. Select only
the first override port under RCU and stop after handing it the skb,
regardless of the lower transmit result. Keep the existing success and
drop accounting.

BUG: KASAN: slab-use-after-free in sk_skb_reason_drop
Write of size 4 by task poc/5040
sk_skb_reason_drop (net/core/skbuff.c:1240)
dev_kfree_skb_any_reason (net/core/dev.c:3470)
ab_transmit (drivers/net/team/team_mode_activebackup.c:49)
team_xmit (drivers/net/team/team_core.c:1849)
__dev_direct_xmit (net/core/dev.c:4934)
Freed by task 5040:
__tcf_kfree_skb_list (net/sched/sch_generic.c:43)
__dev_queue_xmit (net/core/dev.c:4831)
team_xmit (drivers/net/team/team_core.c:1846)
Kernel panic - not syncing: KASAN: panic_on_warn set ...

Published: 2026-10-23

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s networking “team” module contains a flaw where a non‑zero result from dev_queue_xmit() does not transfer ownership of the skbuff to the caller. When a port’s qdisc drops the packet, the helper that retries another port or falls back to the mode transmit operation can reuse the freed skbuff, causing a use‑after‑free that triggers a kernel panic. This results in a system crash, effectively denying availability to all processes. The vulnerability is identified by CWE‑825.

Affected Systems

The bug is present in any Linux kernel compiling the team driver that has not applied the patch commits linked in the advisory. All distributions that ship the affected kernel are vulnerable. No specific kernel versions are listed, so all potentially affected releases require review.

Risk and Exploitability

The CVSS score is 5.5, and the EPSS score is < 1%. The flaw is not listed in the CISA KEV catalog. The bug produces a kernel panic, indicating a moderate‑to‑high severity denial of service risk. Exploitation would require the ability to inject or drive traffic through a team interface; local or broadcast traffic that reaches the team driver can trigger the fault. The low EPSS suggests that the exploitation probability is currently low, but the impact of a crash would be catastrophic for availability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< 13be794844e368b4f8e8d33e97efa23c0a1ebaf8
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< e40846f661075c4c653988363f38e6868bd0a240
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< eaf49fba9cd054e84906d2416e8662194f763c9e
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< b21f20320fa2f3c683e3334d70de6bfd172e544a
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< 07a48cfceb3d0555710a9acb87c949500a7b4523
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< 0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< bed63353341d2d44cbad034001dd382cfe3a3892
`8ff5105a2b9dd0ba596719b165c1827d101e5f1a`	affected	< b7454f1940c5e6d92e753853c476a769e452f30a

Linux

affected

Version	Status	Constraints
`3.7`	affected	—
`0`	unaffected	< 3.7
`5.10.273`	unaffected	≤ 5.10.*
`5.15.224`	unaffected	≤ 5.15.*
`6.1.191`	unaffected	≤ 6.1.*
`6.6.160`	unaffected	≤ 6.6.*
`6.12.114`	unaffected	≤ 6.12.*
`6.18.57`	unaffected	≤ 6.18.*
`7.2.11`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,b21f20320fa2f3c683e3334d70de6bfd172e544a)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,07a48cfceb3d0555710a9acb87c949500a7b4523)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,bed63353341d2d44cbad034001dd382cfe3a3892)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,b7454f1940c5e6d92e753853c476a769e452f30a)`	affected	code_commit	—

Linux

100%

Version	Status	Scheme	Platform
`3.7`	affected	generic	—
`[0,3.7)`	unaffected	generic	—
`[6.6.160,6.7.0]`	unaffected	semver	—
`[6.12.114,6.13.0]`	unaffected	semver	—
`[6.18.57,6.19.0]`	unaffected	semver	—
`[7.2.11,7.3.0]`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,b21f20320fa2f3c683e3334d70de6bfd172e544a)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,07a48cfceb3d0555710a9acb87c949500a7b4523)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,bed63353341d2d44cbad034001dd382cfe3a3892)`	affected	code_commit	—
`[8ff5105a2b9dd0ba596719b165c1827d101e5f1a,b7454f1940c5e6d92e753853c476a769e452f30a)`	affected	code_commit	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`3.7`	affected	generic	—
`[0,3.7)`	unaffected	generic	—
`[6.6.160,6.7.0]`	unaffected	semver	—
`[6.12.114,6.13.0]`	unaffected	semver	—
`[6.18.57,6.19.0]`	unaffected	semver	—
`[7.2.11,7.3.0]`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to a revision that includes the commit changes preventing skbuff reuse after queue override (the commits referenced in the advisory should be applied).
If an immediate kernel upgrade is not possible, temporarily disable the Linux ‘team’ network interface or replace it with another bonding method to avoid the affected code path.
Continuously monitor system logs for KASAN messages or kernel panics related to network traffic and enforce strict network segmentation to limit the ability of untrusted sources to target the vulnerable interface.

Generated by OpenCVE AI on October 29, 2026 at 14:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-9018-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9018-2	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00185.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99027.mbox
https://git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523
https://git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e
https://git.kernel.org/stable/c/13be794844e368b4f8e8d33e97efa23c0a1ebaf8
https://git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a
https://git.kernel.org/stable/c/b7454f1940c5e6d92e753853c476a769e452f30a
https://git.kernel.org/stable/c/bed63353341d2d44cbad034001dd382cfe3a3892
https://git.kernel.org/stable/c/e40846f661075c4c653988363f38e6868bd0a240
https://git.kernel.org/stable/c/eaf49fba9cd054e84906d2416e8662194f763c9e
https://nvd.nist.gov/vuln/detail/CVE-2026-99027
https://www.cve.org/CVERecord?id=CVE-2026-99027

History

Fri, 30 Oct 2026 13:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/13be794844e368b4f8e8d33e97efa23c0a1ebaf8 https://git.kernel.org/stable/c/e40846f661075c4c653988363f38e6868bd0a240 https://git.kernel.org/stable/c/eaf49fba9cd054e84906d2416e8662194f763c9e

Thu, 29 Oct 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-99027.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-99027 https://www.cve.org/CVERecord?id=CVE-2026-99027
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 23 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Fri, 23 Oct 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb. Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting. BUG: KASAN: slab-use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849) __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ...
Title		net: team: stop reusing skb after queue override
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523 https://git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e https://git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a https://git.kernel.org/stable/c/b7454f1940c5e6d92e753853c476a769e452f30a https://git.kernel.org/stable/c/bed63353341d2d44cbad034001dd382cfe3a3892

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-23T12:21:14.896Z

Updated: 2026-10-30T12:41:02.988Z

Reserved: 2026-09-25T10:25:14.386Z

Link: CVE-2026-99027

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-23T13:17:25.723

Modified: 2026-10-30T13:21:39.203

Link: CVE-2026-99027

Redhat

Severity : Moderate

Publid Date: 2026-10-23T00:00:00Z

Links: CVE-2026-99027 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-29T14:30:16Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object