In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero dev_queue_xmit()… (CVE-2026-99027)

CVE-2026-99027 addresses a use-after-free vulnerability in the Linux kernel's network team driver. The vulnerability arises because a nonzero return from dev_queue_xmit() does not return ownership of the skb, and when an override port's qdisc drops the skb, the queue override helper attempts to reuse the freed skb improperly. The fix separates the handoff decision from transmit success, ensuring only the first override port is selected and the skb is not reused after being freed. The flaw was detected by KASAN as a slab-use-after-free in sk_skb_reason_drop, leading to kernel panic under certain conditions.

This vulnerability can lead to kernel memory corruption and system crashes (kernel panic), causing denial of service. It affects the stability and reliability of systems running the vulnerable Linux kernel network team driver. There is no indication from the data that this vulnerability allows privilege escalation or remote code execution.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates that include this patch. Since no vendor advisory or patch links are provided, users should monitor the Linux kernel mailing lists or official repositories for the relevant patch. No additional mitigation actions are specified.