Use-after-free in Linux kernel - CVE-2026-99027

Vulnerability details

The vulnerability allows a local user to cause a denial of service by triggering a kernel crash.

The vulnerability exists due to use-after-free in the Linux kernel team driver's queue override transmission helper when an override port's queueing discipline drops a packet buffer and transmission returns a nonzero result. A local user can trigger packet transmission through the affected queue override path to cause the freed buffer to be reused for another port or the mode transmit operation, potentially crashing the kernel.

Affected software

How to mitigate CVE-2026-99027

External References

• https://git.kernel.org/stable/c/07a48cfceb3d0555710a9acb87c949500a7b4523
• https://git.kernel.org/stable/c/0c0568c9d35c47dc8e3ef6705d4c35a02bd88c4e
• https://git.kernel.org/stable/c/b21f20320fa2f3c683e3334d70de6bfd172e544a
• https://git.kernel.org/stable/c/b7454f1940c5e6d92e753853c476a769e452f30a
• https://git.kernel.org/stable/c/bed63353341d2d44cbad034001dd382cfe3a3892

Related Security Bulletins

• Use-after-free in Linux kernel net team driver
• Debian update for linux