CVE-2026-99027 (GCVE-0-2026-99027)
Vulnerability from cvelistv5
Published
2026-10-23 12:21
Modified
2026-10-30 12:41
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: team: stop reusing skb after queue override
A nonzero dev_queue_xmit() result does not return ownership of the skb.
When an override port's qdisc drops it, the queue override helper used to
try another port or the mode transmit op with the freed skb.
Return the handoff decision separately from transmit success. Select only
the first override port under RCU and stop after handing it the skb,
regardless of the lower transmit result. Keep the existing success and
drop accounting.
BUG: KASAN: slab-use-after-free in sk_skb_reason_drop
Write of size 4 by task poc/5040
sk_skb_reason_drop (net/core/skbuff.c:1240)
dev_kfree_skb_any_reason (net/core/dev.c:3470)
ab_transmit (drivers/net/team/team_mode_activebackup.c:49)
team_xmit (drivers/net/team/team_core.c:1849)
__dev_direct_xmit (net/core/dev.c:4934)
Freed by task 5040:
__tcf_kfree_skb_list (net/sched/sch_generic.c:43)
__dev_queue_xmit (net/core/dev.c:4831)
team_xmit (drivers/net/team/team_core.c:1846)
Kernel panic - not syncing: KASAN: panic_on_warn set ...
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a Version: 8ff5105a2b9dd0ba596719b165c1827d101e5f1a |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "13be794844e368b4f8e8d33e97efa23c0a1ebaf8",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "e40846f661075c4c653988363f38e6868bd0a240",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "eaf49fba9cd054e84906d2416e8662194f763c9e",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "b21f20320fa2f3c683e3334d70de6bfd172e544a",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "07a48cfceb3d0555710a9acb87c949500a7b4523",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "bed63353341d2d44cbad034001dd382cfe3a3892",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
},
{
"lessThan": "b7454f1940c5e6d92e753853c476a769e452f30a",
"status": "affected",
"version": "8ff5105a2b9dd0ba596719b165c1827d101e5f1a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/team/team_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.273",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.224",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.273",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.224",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.160",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.114",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.57",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.11",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: team: stop reusing skb after queue override\n\nA nonzero dev_queue_xmit() result does not return ownership of the skb.\nWhen an override port\u0027s qdisc drops it, the queue override helper used to\ntry another port or the mode transmit op with the freed skb.\n\nReturn the handoff decision separately from transmit success. Select only\nthe first override port under RCU and stop after handing it the skb,\nregardless of the lower transmit result. Keep the existing success and\ndrop accounting.\n\n BUG: KASAN: slab-use-after-free in sk_skb_reason_drop\n Write of size 4 by task poc/5040\n sk_skb_reason_drop (net/core/skbuff.c:1240)\n dev_kfree_skb_any_reason (net/core/dev.c:3470)\n ab_transmit (drivers/net/team/team_mode_activebackup.c:49)\n team_xmit (drivers/net/team/team_core.c:1849)\n __dev_direct_xmit (net/core/dev.c:4934)\n Freed by task 5040:\n __tcf_kfree_skb_list (net/sched/sch_generic.c:43)\n __dev_queue_xmit (net/core/dev.c:4831)\n team_xmit (drivers/net/team/team_core.c:1846)\n Kernel panic - not syncing: KASAN: panic_on_warn set ..."
}
],
"providerMetadata": {
"dateUpdated": "2026-10-30T12:41:02.988Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/13be794844e368b4f8e8d33e97efa23c0a1ebaf8"
},
{
"url": "https://git.kernel.org/stable/c/e40846f661075c4c653988363f38e6868bd0a240"
},
{
"url": "https://git.kernel.org/stable/c/eaf49fba9cd054e84906d2416e8662194f763c9e"
},
{
"url": "https://git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a"
},
{
"url": "https://git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523"
},
{
"url": "https://git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e"
},
{
"url": "https://git.kernel.org/stable/c/bed63353341d2d44cbad034001dd382cfe3a3892"
},
{
"url": "https://git.kernel.org/stable/c/b7454f1940c5e6d92e753853c476a769e452f30a"
}
],
"title": "net: team: stop reusing skb after queue override",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99027",
"datePublished": "2026-10-23T12:21:14.896Z",
"dateReserved": "2026-09-25T10:25:14.386Z",
"dateUpdated": "2026-10-30T12:41:02.988Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…