CVE-2026-72390

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF

The teql master->slaves singly linked list is not protected against

multiple writes. It can be mod'ed concurently from teql_master_xmit(),

teql_dequeue(), teql_init() and teql_destroy() without holding any list

lock or RCU protection.

[email protected] has demonstrated that the qdisc is freed

after an RCU grace period, but teql_master_xmit() running on another

CPU can still hold a stale pointer into the list, resulting in a

slab-use-after-free:

BUG: KASAN: slab-use-after-free in teql_master_xmit+0xf0f/0x16b0

Read of size 8 at addr ffff888013fb0440 by task poc/332

Freed 512-byte region [ffff888013fb0400, ffff888013fb0600) (kmalloc-512)

The fix?

Add a per-master slaves_lock spinlock that serializes all mutations of

master->slaves and the NEXT_SLAVE() links in teql_destroy() and

teql_qdisc_init(). teql_master_xmit() also takes the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References