Linux kernel teql use-after-free in net/sched (CVE-2026-99282)
CVE-2026-99282 Published on November 7, 2026
net/sched: sch_teql: fix use-after-free on lower qdisc drop
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: fix use-after-free on lower qdisc drop
The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return
value against NETDEV_TX_OK alone. A slave that consumes the skb but
returns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated
as if the skb were still owned, so the loop restores skb->dev and calls
__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()
from its ndo_start_xmit() (propagated since cbbef5e18307), and when the
lower qdisc drops the packet that value is NET_XMIT_DROP after the skb
has been freed, giving a use-after-free in teql_master_xmit().
The Fix: test for consumption with dev_xmit_complete(), which accepts
NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that
need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps
the packet counted in tx_packets/tx_bytes and advances the slave; a
consumed result that is neither a success nor NET_XMIT_CN ends the
attempt and is charged to tx_dropped, so lower-qdisc drops are no longer
reported as good transmits. NET_XMIT_CN is counted like success because
it can accompany acceptance of the current packet: pfifo_head_drop drops
the old head, enqueues the current skb and returns NET_XMIT_CN.
Conditions to recreate the bug:
With CONFIG_NET_SCH_TEQL,
CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and
lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0
and a teql0 root on lkrvlan0; bring teql0 up with an address and send one
UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower
qdisc while holding a freed skb.
Products Associated with CVE-2026-99282
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 572a9d7b6fc7f20f573664063324c086be310c42 and below fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde is affected.
- Version 572a9d7b6fc7f20f573664063324c086be310c42 and below 2702ae318630787c640ec0d0403ffd9d95c43e9e is affected.
- Version 572a9d7b6fc7f20f573664063324c086be310c42 and below 782d6bb8f9b8e9d8591181662222bf74cd3ecf79 is affected.
- Version 2.6.33 is affected.
- Before 2.6.33 is unaffected.
- Version 6.18.61, <= 6.18.* is unaffected.
- Version 7.3.2, <= 7.3.* is unaffected.
- Version 7.4-rc1, <= * is unaffected.