Cloudanix VulnDB

CVE-2026-99027

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A recently fixed flaw in Linux networking could let specially crafted traffic crash the entire system by reusing memory that had already been freed.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free when the team driver reuses an skb after dev_queue_xmit returns a nonzero result and a qdisc has already freed it, occurring in sk_skb_reason_drop during ab_transmit or team_xmit paths.

Why it matters to the business

Systems using Linux team networking interfaces may experience kernel crashes or panics under specific traffic and queuing conditions, leading to denial of service and potential loss of network connectivity until reboot.

How an attack unfolds

An attacker sends crafted network traffic that causes the team active-backup mode to attempt transmission on an override port whose qdisc drops the skb; the driver then reuses the now-freed skb, triggering the use-after-free when further transmit attempts or accounting occur.

How to fix it

Apply the upstream fix that separates handoff decision from transmit result and selects only the first override port under RCU; monitor stable kernel releases for the patch and update as soon as a fixed version is available.

How to confirm the fix worked

Confirm the patch is present by inspecting team_mode_activebackup.c and team_core.c for the new return-value handling logic; test with network stress tools that exercise qdisc drops on team interfaces and verify absence of KASAN reports.

Typical attack path

  1. Identify hosts using the Linux team driver with activebackup mode
  2. Send traffic that triggers queue override and qdisc drop paths in team_xmit
  3. Force reuse of the skb after __tcf_kfree_skb_list has freed it
  4. Trigger sk_skb_reason_drop or dev_kfree_skb_any_reason on the dangling pointer
  5. Cause KASAN-detected slab corruption and kernel panic

How to detect it

Review kernel logs for KASAN slab-use-after-free reports mentioning sk_skb_reason_drop, dev_kfree_skb_any_reason, ab_transmit, or team_xmit; correlate with team interface activity and qdisc drop events.

What your security team should do

  • Prioritize kernel updates on any system exposing team interfaces to untrusted networks
  • Disable team interfaces or switch to alternative bonding modes until patched
  • Enable KASAN or similar memory debugging in test environments to detect similar issues early
  • Monitor kernel changelogs for the exact commit that resolves the skb reuse bug

The record

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb. Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting. BUG: KASAN: slab-use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849) __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ...

Affected packages

Ecosystem Package Introduced Fixed