Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99026— net: team: free skb when broadcast has no txable port

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： net: team: 当广播没有可发送端口时释放 skb 函数会将原始套接字缓冲区（skb）通过最后一个可发送（txable）的端口发出。 当没有任何端口处于可发送状态时，该函数返回 且未消耗（consume）该 skb，但 仍返回 。这导致 保留该 skb 及其对应的 socket 写内存占用（write-memory charge）。 一个启用了 TX 但链路已断开（link-down）的端口会保持广播发送操作（broadcast transmit op）的注册状态

AI Predicted 7.8 Difficulty: Moderate

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 8

VendorProduct Version RangeStatus
Linux Linux 5fc889911a99043a97da1daa0d010ad72cbc3042< 961563117626f4681623077ec0cfd86f86da0d49 affected
5fc889911a99043a97da1daa0d010ad72cbc3042< f34b1bcac4581a5bd3daf9eff90f175e736b54aa affected
5fc889911a99043a97da1daa0d010ad72cbc3042< 489114c9ecae44e523361a4b3e610ee5ebd9189c affected
3.6 affected
< 3.6 unaffected
6.18.57≤ 6.18.* unaffected
7.2.11≤ 7.2.* unaffected
7.3≤ * unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99026

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: team: free skb when broadcast has no txable port
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the skb and its socket write-memory charge. A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact. Discovered by Sashiko during review of previous commit.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 5fc889911a99043a97da1daa0d010ad72cbc3042 ~ 961563117626f4681623077ec0cfd86f86da0d49 -
Linux Linux 3.6 -

II. Public POCs for CVE-2026-99026

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99026

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99026 (3)

Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-98975 7.8 HIGH xfs: stop exchanging reflink flags when exchanging mappings
CVE-2026-98889 7.8 HIGH wifi: iwlwifi: mvm: fix sched scan IE sizing
CVE-2026-99050 7.8 HIGH gpio: mpsse: fix race when arming the IRQ poll worker
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99056 7.8 HIGH strparser: make sure __strp_recv isn't running before tearing down the parser
CVE-2026-98974 7.8 HIGH xfs: fix exchange-range-to-eof file size exchange
CVE-2026-98976 7.8 HIGH namespace: keep the lock on a mount that a propagated copy is moved beneath

Showing top 20 of 218 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-99026

No comments yet

Leave a comment