Cloudanix VulnDB

CVE-2026-99026

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A Linux networking feature can leak small amounts of memory when handling certain broadcast messages, and over time this can slow down or destabilize the machine.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Failure to free socket buffer (skb) and associated socket write-memory charge in team driver bc_transmit() when no TX-able port exists, while team_xmit() incorrectly returns NETDEV_TX_OK; broadcast transmit remains registered on link-down TX-enabled ports.

Why it matters to the business

Gradual memory exhaustion on Linux systems using network teaming, potentially causing performance degradation, socket limits, or system instability under sustained broadcast traffic.

How an attack unfolds

An attacker generates broadcast packets directed at a team interface configured such that all ports are non-TX-able (link-down or disabled); the kernel leaks each skb and its memory accounting instead of dropping it cleanly, allowing repeated transmissions to accumulate un-reclaimed memory.

How to fix it

Apply the upstream kernel commit that frees the skb on the no-txable-port path in bc_transmit() while preserving existing drop accounting; rebuild and reboot with the corrected kernel.

How to confirm the fix worked

Inspect team.c source for the skb free on the false return path from bc_transmit(); confirm team_xmit() no longer returns NETDEV_TX_OK without skb consumption; test broadcast transmission with all ports down.

Typical attack path

  1. Identify or configure a Linux host using the team network driver with at least one broadcast-capable interface
  2. Ensure or induce a state where no port is TX-able while carrier remains up
  3. Transmit broadcast frames (e.g., via raw sockets or AF_PACKET)
  4. Observe repeated failure to consume skb in bc_transmit leading to retained write-memory charges

How to detect it

Review kernel logs and slabinfo for elevated skb or sock objects on team devices; correlate with netdev transmit paths; examine processes using AF_PACKET or raw sockets for abnormal memory growth.

What your security team should do

  • Prioritize kernel upgrade on any system exposing team interfaces to untrusted broadcast traffic
  • Monitor per-socket and network memory usage for unexplained growth on team devices
  • Disable team interfaces or restrict broadcast reception until patched if memory pressure is observed

The record

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but team_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the skb and its socket write-memory charge. A TX-enabled, link-down port keeps the broadcast transmit op installed. Carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. Free the original skb on the no-port path while leaving the existing drop accounting intact. Discovered by Sashiko during review of previous commit.

Affected packages

Ecosystem Package Introduced Fixed