Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-11-07T14:08:47 kernel: kernel: Denial of Service via use-after-free in sch_teql 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CWE-416

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes the skb but returns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated as if the skb were still owned, so the loop restores skb->dev and calls __skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit() from its ndo_start_xmit() (propagated since cbbef5e18307), and when the lower qdisc drops the packet that value is NET_XMIT_DROP after the skb has been freed, giving a use-after-free in teql_master_xmit(). The Fix: test for consumption with dev_xmit_complete(), which accepts NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps the packet counted in tx_packets/tx_bytes and advances the slave; a consumed result that is neither a success nor NET_XMIT_CN ends the attempt and is charged to tx_dropped, so lower-qdisc drops are no longer reported as good transmits. NET_XMIT_CN is counted like success because it can accompany acceptance of the current packet: pfifo_head_drop drops the old head, enqueues the current skb and returns NET_XMIT_CN. Conditions to recreate the bug: With CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0 and a teql0 root on lkrvlan0; bring teql0 up with an address and send one UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower qdisc while holding a freed skb.

A flaw was found in the Linux kernel's Traffic Equalizer (sch_teql) network scheduler. This flaw allows an attacker to cause a Denial of Service (DoS) by transmitting network traffic through an affected network interface. During packet transmission, if a subordinate network device or lower queueing discipline drops a packet, the teql driver fails to recognize that the packet buffer was consumed and freed. Consequently, the kernel attempts to access the already freed buffer, resulting in a use-after-free condition and a system crash.

sch_teql treated every ndo_start_xmit result other than NETDEV_TX_OK as if the skb had not been consumed. A VLAN slave can propagate NET_XMIT_DROP after the lower qdisc has already freed the skb, after which teql_master_xmit writes skb dev and calls __skb_pull on freed memory. This provides a concrete use after free access and can cause a kernel crash. Reallocation of the freed skb before these writes may also corrupt another object, so privilege escalation cannot be excluded even though no arbitrary write primitive is proven. For the CVSS the PR:L value assumes a local user or process can generate traffic through an existing vulnerable TEQL and VLAN configuration. Creating the required qdisc topology normally requires CAP_NET_ADMIN. Direct remote reachability is not established and the specific network configuration raises attack complexity. To mitigate this issue, prevent the sch_teql kernel module from loading by executing the following command as root: # echo "install sch_teql /bin/true" >> /etc/modprobe.d/disable-sch_teql.conf If the module is currently loaded and not in use, remove it: # modprobe -r sch_teql Warning: A system reboot may be required if the module is actively in use and cannot be unloaded. Disabling this module prevents the use of the True Equalizer (TEQL) queueing discipline, which may affect network setups that rely on this feature. Red Hat Enterprise Linux 10 Not affected kernel Red Hat Enterprise Linux 6 Out of support scope kernel Red Hat Enterprise Linux 7 Affected kernel Red Hat Enterprise Linux 7 Affected kernel-rt Red Hat Enterprise Linux 8 Affected kernel Red Hat Enterprise Linux 8 Affected kernel-rt Red Hat Enterprise Linux 9 Not affected kernel Red Hat Enterprise Linux 9 Not affected kernel-rt Red Hat OpenShift Container Platform 4 Affected openshift/ose-rhel-coreos-8 Red Hat OpenShift Container Platform 4 Not affected openshift/ose-rhel-coreos-9 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-10 Red Hat OpenShift Container Platform 5 Not affected openshift/ose-rhel-coreos-9 https://www.cve.org/CVERecord?id=CVE-2026-99282 https://nvd.nist.gov/vuln/detail/CVE-2026-99282 https://git.kernel.org/stable/c/2702ae318630787c640ec0d0403ffd9d95c43e9e https://git.kernel.org/stable/c/782d6bb8f9b8e9d8591181662222bf74cd3ecf79 https://git.kernel.org/stable/c/fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde https://kernelcve.org/list/?q=CVE-2026-99282