---
id: "CVE-2026-99026"
kind: "vulnerability"
aliases: ["CVE-2026-99026"]
title: "Linux kernel team driver leaks sent packets, exhausting socket memory"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kernel", "linux", "networking", "runtime", "self-hosted"]
not_affected_if: ["team-driver-not-loaded"]
published_at: "2026-10-23T13:17:25+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T04:54:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99026", "first_seen_at": "2026-10-23T21:57:33+00:00"}]
---

# Linux kernel team driver leaks sent packets, exhausting socket memory

In the Linux kernel's team network driver, broadcast transmit can return success without freeing the packet when no port can transmit. The packet and its socket memory charge are then retained by the sender, which can exhaust memory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel version listed by your distribution's advisory (unknown in the sources)
- Check whether the team driver is loaded with `lsmod | grep team`

## Fix

- Update the Linux kernel to a release that includes the upstream fix for 'net: team: free skb when broadcast has no txable port' (exact version unknown in the sources)

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99026

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net: team: free skb when broadcast has no txable port

bc_transmit() sends the original skb through the last txable port.
When no port is txable, it returns false without consuming the skb, but
team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the
skb and its socket write-memory charge.

A TX-enabled, link-down port keeps the broadcast transmit op installed.
Carrier can stay up through a second link-up, TX-disabled port or be
forced on by userspace. Free the original skb on the no-port path while
leaving the existing drop accounting intact.

Discovered by Sashiko during review of previous commit.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_