CVE-2026-99027: Linux kernel · net: team: stop reusing skb after queue override
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in bed63353341d2d44cbad034001dd382cfe3a3892 : patch Linux kernel soon.
Data as of 26 Oct 2026, 13:07 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 7% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in bed63353341d2d44cbad034001dd382cfe3a3892, b7454f1940c5e6d92e753853c476a769e452f30a, b21f20320fa2f3c683e3334d70de6bfd172e544a +2
Exploitation evidence
Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in the Linux kernel as indicated by the presence of fixed commit versions. Users and administrators should update to a Linux kernel version that includes these fixes to remediate the vulnerability. No additional mitigation steps are specified or required beyond applying the official patch.
Description
CVE-2026-99027 is a vulnerability in the Linux kernel's network team driver where the reuse of socket buffers (skb) after a queue override can lead to a use-after-free condition. This occurs because a nonzero return from dev_queue_xmit() does not relinquish ownership of the skb, causing the queue override helper to improperly reuse freed memory. The flaw can trigger kernel memory corruption and a kernel panic under certain conditions.
References
- git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a (opens in a new tab)
- git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523 (opens in a new tab)
- git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e (opens in a new tab)
- git.kernel.org/stable/c/bed63353341d2d44cbad034001dd382cfe3a3892 (opens in a new tab)
- git.kernel.org/stable/c/b7454f1940c5e6d92e753853c476a769e452f30a (opens in a new tab)