Live › vulnerability › CVE-2026-99026
Go to dashboardIn the Linux kernel's team network driver, broadcast transmit can return success without freeing the packet when no port can transmit. The packet and its socket memory charge are then retained by the sender, which can exhaust memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that use the Linux team driver (network bonding/teaming) with broadcast transmit and ports that are TX-enabled but link-down or TX-disabled are the relevant setups. Hosts without the team driver loaded are unlikely to be affected. The sources do not say how an attacker would trigger it from outside.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel version listed by your distribution's advisory (unknown in the sources)lsmod | grep teamEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: team: free skb when broadcast has no txable port
bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the skb and its socket write-memory charge.
A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact.
Discovered by Sashiko during review of previous commit.
This page as .md · .json · in your agent: get_signal("CVE-2026-99026")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.