CVE-2026-99026 Linux CVE debrief

Who should care

Defenders and administrators responsible for Linux kernel infrastructure, particularly those managing versions less than 3.6 or with specific commit hashes 961563117626f4681623077ec0cfd86f86da0d49, f34b1bcac4581a5bd3daf9eff90f175e736b54aa, or 489114c9ecae44e523361a4b3e610ee5ebd9189c, should assess exposure and prioritize patching.

Why it matters

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability to prevent potential memory charge issues and ensure infrastructure security.

• Verify and apply patches for Linux kernel versions to prevent potential memory charge issues
• Review and update inventory with specific commit hashes to ensure patch coverage
• Monitor Linux kernel updates and patches for potential impact on infrastructure

Technical summary

The Linux kernel vulnerability in net: team: free skb when broadcast has no txable port has been resolved. The issue arises when bc_transmit() sends the original skb through the last txable port, and when no port is txable, it returns false without consuming the skb. This can lead to AF_PACKET retaining the skb and its socket write-memory charge. A TX-enabled, link-down port keeps the broadcast transmit op installed, and carrier can stay up through a second link-up, TX-disabled port or be forced on by userspace. The original skb is freed on the no-port path while leaving the existing drop accounting intact. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this  

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those with versions less than 3.6 or with specific commit hashes 961563117626f4681623077ec0cfd86f86da0d49, f34b1bcac4581a5bd3daf9eff90f175e736b54aa, or 489114c9ecae44e523361a4b3e610ee5ebd9189c.

Recommended defensive actions

• Verify Linux kernel versions and apply patches for affected versions
• Review and update inventory with specific commit hashes 961563117626f4681623077ec0cfd86f86da0d49, f34b1bcac4581a5bd3daf9eff90f175e736b54aa, or 489114c9ecae44e523361a4b3e610ee5ebd9189c
• Monitor Linux kernel updates and patches for potential impact
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, its resolution, and affected Linux kernel versions. However, the corpus does not establish specific exploitation instances, impact, or remediation beyond patching.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.