{"id":"CVE-2026-99026","kind":"vulnerability","aliases":["CVE-2026-99026"],"related":[],"title":"Linux kernel team driver leaks sent packets, exhausting socket memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: free skb when broadcast has no txable port\n\nbc_transmit() sends the original skb through the last txable port.\nWhen no port is txable, it returns false without consuming the skb, but\nteam_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the\nskb and its socket write-memory charge.\n\nA TX-enabled, link-down port keeps the broadcast transmit op installed.\nCarrier can stay up through a second link-up, TX-disabled port or be\nforced on by userspace. Free the original skb on the no-port path while\nleaving the existing drop accounting intact.\n\nDiscovered by Sashiko during review of previous commit.","summary":"In the Linux kernel's team network driver, broadcast transmit can return success without freeing the packet when no port can transmit. The packet and its socket memory charge are then retained by the sender, which can exhaust memory.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","networking","runtime","self-hosted"],"not_affected_if":["team-driver-not-loaded"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel version listed by your distribution's advisory (unknown in the sources)\n- Check whether the team driver is loaded with `lsmod | grep team`","fix":"- Update the Linux kernel to a release that includes the upstream fix for 'net: team: free skb when broadcast has no txable port' (exact version unknown in the sources)","status":"open","published_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:28+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:54:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for 'net: team: free skb when broadcast has no txable port' (exact version unknown in the sources)","reach":"local","title":"Linux kernel team driver leaks sent packets, exhausting socket memory","impact":"low","summary":"In the Linux kernel's team network driver, broadcast transmit can return success without freeing the packet when no port can transmit. The packet and its socket memory charge are then retained by the sender, which can exhaust memory.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","self-hosted","networking"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Memory leaks from unsent packets exhaust kernel socket memory, causing denial of service","analyst_note":"Confirm the fixed kernel version and which stable branches carry the patch from the kernel.org CVE entry or the linux-kernel commit.","how_to_check":"- Run `uname -r` and compare against the fixed kernel version listed by your distribution's advisory (unknown in the sources)\n- Check whether the team driver is loaded with `lsmod | grep team`","needs_analyst":true,"not_affected_if":["team-driver-not-loaded"],"who_is_affected":"Systems that use the Linux team driver (network bonding/teaming) with broadcast transmit and ports that are TX-enabled but link-down or TX-disabled are the relevant setups. Hosts without the team driver loaded are unlikely to be affected. The sources do not say how an attacker would trigger it from outside.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000636,"input_tokens":3451,"output_tokens":582,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99026':13A,16A 'account':177C 'af':114C 'bc':83C 'broadcast':32B,78C,138C 'carrier':142C 'charg':52B,127C 'commit':186C 'consum':103C 'cve':11A,14A 'disabl':154C 'discov':179C 'driver':4A,31B 'drop':176C 'enabl':131C 'exhaust':8A,61B 'exist':175C 'fals':101C 'follow':68C 'forc':158C 'free':38B,75C,162C 'host':23B 'instal':141C 'intact':178C 'keep':136C 'kernel':2A,17B,27B,66C 'last':91C 'leak':5A 'leav':173C 'link':133C,150C 'link-down':132C 'link-up':149C 'linux':1A,18B,26B,65C 'memori':10A,51B,62B,126C 'net':73C 'netdev':111C 'network':19B,30B 'no-port':168C 'ok':113C 'op':140C 'origin':87C,164C 'packet':7A,40B,47B,115C 'path':171C 'port':43B,82C,93C,96C,135C,155C,170C 'previous':185C 'resolv':72C 'retain':55B,118C 'return':35B,100C,110C 'review':183C 'runtim':20B 'sashiko':181C 'second':148C 'self':22B 'self-host':21B 'send':85C,116C 'sender':58B 'sent':6A 'skb':76C,88C,105C,120C,165C 'socket':9A,50B,123C 'stay':144C 'still':109C 'success':36B 'team':3A,29B,74C,107C 'transmit':33B,45B,84C,139C 'tx':112C,130C,153C 'tx-disabl':152C 'tx-enabl':129C 'txabl':81C,92C,98C 'userspac':161C 'vulner':69C 'without':37B,102C 'write':125C 'write-memori':124C 'xmit':108C","nicknames":[],"mitigations":[],"who_affected":"Systems that use the Linux team driver (network bonding/teaming) with broadcast transmit and ports that are TX-enabled but link-down or TX-disabled are the relevant setups. Hosts without the team driver loaded are unlikely to be affected. The sources do not say how an attacker would trigger it from outside.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:25+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99026","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99026","severity":null,"published_at":"2026-10-23T13:17:25+00:00","modified_at":"2026-10-23T13:17:25+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99026","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99026","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}