CVE-2026-99027 in Linux
Summary
by MITRE • 10/23/2026
In the Linux kernel, the following vulnerability has been resolved:
net: team: stop reusing skb after queue override
A nonzero dev_queue_xmit() result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit op with the freed skb.
Return the handoff decision separately from transmit success. Select only the first override port under RCU and stop after handing it the skb, regardless of the lower transmit result. Keep the existing success and drop accounting.
BUG: KASAN: slab-use-after-free in sk_skb_reason_drop Write of size 4 by task poc/5040 sk_skb_reason_drop (net/core/skbuff.c:1240) dev_kfree_skb_any_reason (net/core/dev.c:3470) ab_transmit (drivers/net/team/team_mode_activebackup.c:49) team_xmit (drivers/net/team/team_core.c:1849) __dev_direct_xmit (net/core/dev.c:4934) Freed by task 5040: __tcf_kfree_skb_list (net/sched/sch_generic.c:43) __dev_queue_xmit (net/core/dev.c:4831) team_xmit (drivers/net/team/team_core.c:1846) Kernel panic - not syncing: KASAN: panic_on_warn set ...
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The Linux kernel network subsystem contains a critical memory safety vulnerability within the Team device driver, specifically affecting the active-backup mode implementation. This flaw arises from an incorrect handling of socket buffer ownership during packet transmission attempts across multiple slave interfaces. In normal operation, when a network interface is unable to transmit a packet due to queue congestion or other constraints, it returns a non-zero value from dev_queue_xmit() without relinquishing control of the associated sk_buff structure. However, in scenarios involving queue override mechanisms where an initial port drops the frame, the original code incorrectly assumed that ownership had been transferred back to the caller, allowing subsequent logic to reuse the same buffer for transmission on alternative ports or modes. This assumption violates fundamental networking stack protocols regarding memory management and leads directly to use-after-free conditions when the kernel attempts to free resources associated with a buffer that is still being referenced elsewhere in the execution path.
The technical root cause lies in the team_xmit function within drivers/net/team/team_core.c, which coordinates packet distribution among member interfaces of a bonded network device. When an override port's queueing discipline drops a packet, the helper logic previously attempted to retry transmission on another interface using the same sk_buff pointer. Because dev_queue_xmit() does not transfer ownership upon failure or drop conditions in this specific context, reusing the buffer results in multiple references pointing to freed memory regions once one path completes its cleanup cycle. This race condition manifests as a slab-use-after-free error detected by Kernel Address Sanitizer during write operations within sk_skb_reason_drop and subsequent calls to dev_kfree_skb_any_reason. The vulnerability is particularly dangerous because it can be triggered remotely through crafted network traffic that forces queue drops on primary interfaces, causing the kernel to panic due to memory corruption in active-backup bonding configurations.
From a security perspective, this vulnerability aligns with CWE-416, Use After Free, and represents a significant risk to system stability and potential privilege escalation if an attacker can induce repeated failures leading to exploitable heap states. In terms of the MITRE ATT&CK framework for Enterprise, this flaw relates to techniques involving exploitation of software vulnerabilities during initial access or lateral movement phases where kernel-level crashes may be leveraged to disrupt service availability or potentially escape container boundaries in virtualized environments. The impact includes denial of service through kernel panics and potential information disclosure if specific heap layouts allow leakage of sensitive data stored near the freed buffer region.
Mitigation strategies require applying upstream Linux kernel patches that correct the ownership semantics within the team driver logic. Developers must ensure that dev_queue_xmit() return values are interpreted correctly, distinguishing between transmission success and handoff decisions. The fix involves selecting only the first override port under RCU protection and stopping further attempts after handing off the sk_buff, regardless of lower-level transmit results. System administrators should update their kernel versions to include these fixes and monitor for any signs of network interface instability or unexpected reboots in systems utilizing team devices with active-backup modes. Regular security auditing using static analysis tools capable of detecting use-after-free patterns can help identify similar issues in custom networking code before deployment.