CVE-2026-99027: Linux Vulnerability

Description

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb. Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting. BUG: KASAN: slab-use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849) __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ...

Metrics

EPSS Probability

0.18%

7.1th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < 13be794844e368b4f8e8d33e97efa23c0a1ebaf8; >= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < e40846f661075c4c653988363f38e6868bd0a240; >= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < eaf49fba9cd054e84906d2416e8662194f763c9e; >= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < b21f20320fa2f3c683e3334d70de6bfd172e544a; >= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < 07a48cfceb3d0555710a9acb87c949500a7b4523; >= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < 0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e; >= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < bed63353341d2d44cbad034001dd382cfe3a3892; >= 8ff5105a2b9dd0ba596719b165c1827d101e5f1a, < b7454f1940c5e6d92e753853c476a769e452f30a
Linux	Linux	3.7

References

Timeline

Published: Oct 23, 2026
Last Modified: Oct 30, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-99027?

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb. Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting. BUG: KASAN: slab-use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849) __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ...

How severe is CVE-2026-99027?

Severity scoring for CVE-2026-99027 is pending analysis. The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.

How do I fix CVE-2026-99027?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →