In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bc_transmit() sends the… (CVE-2026-99026)

The Linux kernel network team driver had a flaw where broadcast packets were not properly freed if no transmitable port was available. Specifically, bc_transmit() would return false without consuming the skb, but team_xmit() would still report success (NETDEV_TX_OK). This caused AF_PACKET sockets to retain the skb and its socket write-memory charge, potentially leading to resource retention. The issue was discovered during a code review and fixed by freeing the original skb on the no-port path, preserving drop accounting.

The vulnerability can cause resource retention in the kernel due to socket buffers not being freed when no transmitable port exists for broadcast packets. This could lead to increased memory usage and socket write-memory charge retention, potentially affecting system stability or performance under certain network conditions. There is no indication of code execution or privilege escalation.

No explicit patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.