Vulnerability-Lookup

FKIE_CVE-2026-90071

Vulnerability from fkie_nvd - Published: 2026-09-17 17:16 - Updated: 2026-10-19 09:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: restore skb->dev on the slave failure path teql_master_xmit() sets skb->dev = slave before calling the slave's ndo_start_xmit(), but never restores it when that transmit fails. The skb then walks on to the next slave still pointing at the previous one. If a later slave has no resolved neighbour, teql_resolve() hands the skb to neigh_event_send(), which queues it on that neighbour's arp_queue with the stale skb->dev. skb->dev holds no reference, so deleting the previous slave frees the net_device while the skb is still queued. Whatever runs next on that skb - arp_error_report() on timeout, or neigh_direct_output() -> dev_queue_xmit() once the neighbour resolves - causes a UAF like the one below: BUG: KASAN: slab-use-after-free in __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) Read of size 4 at addr ffff888106e100b0 by task flood_packet/527 CPU: 0 UID: 0 PID: 527 Comm: flood_packet Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) ? __pfx__raw_spin_lock_irqsave (./include/asm-generic/qrwlock.h:122 (discriminator 4)) ? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) kasan_report (mm/kasan/report.c:595) ? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) [...] ipv4_link_failure (net/ipv4/route.c:1251 net/ipv4/route.c:1258) ? __pfx_ipv4_link_failure (./include/linux/skbuff.h:4327) ? _raw_write_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:1301 ./include/asm-generic/qrwlock.h:98 ./include/linux/rwlock_api_smp.h:230 kernel/locking/spinlock.c:304) ? __pfx__raw_write_lock (kernel/locking/spinlock.c:175) arp_error_report (./include/net/dst.h:438 net/ipv4/arp.c:296) neigh_invalidate (net/core/neighbour.c:1077) neigh_timer_handler (net/core/neighbour.c:1169) [...] Allocated by task 505: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) __kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:6905) alloc_netdev_mqs (net/core/dev.c:12055 (discriminator 2)) rtnl_create_link (net/core/rtnetlink.c:3721) rtnl_newlink (net/core/rtnetlink.c:3903 net/core/rtnetlink.c:4044 net/core/rtnetlink.c:4159) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) [...] Freed by task 536: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692) device_release (drivers/base/core.c:2636) kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737) netdev_run_todo (net/core/dev.c:11756) rtnl_dellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3651) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) [...] Fix this by restoring skb->dev to the master at the end of each slave's iteration.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/00d8a387b23b7831ad9919256a6b9caaa10f19c3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/012559cf3c67ce8825a31d4f66b040b6fbaf775e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0cd75037948567193f7f5767176538822ce23873
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/1360bc93f5be1be3cf937ebea667b3418dd30a79
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/96bc345a3f17543d0d92ada609e02198d6380e26
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/aa39a790d56b40bfcf3861653ceb46a3a113adb6
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d453bf439ef230b5743afc25e194adacca8c6e43
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dc4b95b8fee95113587e93ca116356032d271371

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1360bc93f5be1be3cf937ebea667b3418dd30a79",
              "status": "affected",
              "version": "383493b9940e3d1b5517424081b3e072e20ec43c",
              "versionType": "git"
            },
            {
              "lessThan": "d453bf439ef230b5743afc25e194adacca8c6e43",
              "status": "affected",
              "version": "6b1f563d670162e188a0f2aec39c24b67b106e17",
              "versionType": "git"
            },
            {
              "lessThan": "012559cf3c67ce8825a31d4f66b040b6fbaf775e",
              "status": "affected",
              "version": "57c153249143333bbf4ecf927bdf8aa2696ee397",
              "versionType": "git"
            },
            {
              "lessThan": "aa39a790d56b40bfcf3861653ceb46a3a113adb6",
              "status": "affected",
              "version": "59b06d8b9bdb6b64b3c534c18da68bce5ccd31be",
              "versionType": "git"
            },
            {
              "lessThan": "00d8a387b23b7831ad9919256a6b9caaa10f19c3",
              "status": "affected",
              "version": "81a43e8005366f16e629d8c95dfe05beaa8d36a7",
              "versionType": "git"
            },
            {
              "lessThan": "96bc345a3f17543d0d92ada609e02198d6380e26",
              "status": "affected",
              "version": "0bad9c86edd22dec4df83c2b29872d66fd8a2ff4",
              "versionType": "git"
            },
            {
              "lessThan": "0cd75037948567193f7f5767176538822ce23873",
              "status": "affected",
              "version": "0cc0c2e661af418bbf7074179ea5cfffc0a5c466",
              "versionType": "git"
            },
            {
              "lessThan": "dc4b95b8fee95113587e93ca116356032d271371",
              "status": "affected",
              "version": "0cc0c2e661af418bbf7074179ea5cfffc0a5c466",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21ea283c2750c8307aa35ee832b0951cc993c27d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.52",
              "status": "affected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_teql: restore skb-\u003edev on the slave failure path\n\nteql_master_xmit() sets skb-\u003edev = slave before calling the slave\u0027s\nndo_start_xmit(), but never restores it when that transmit fails. The\nskb then walks on to the next slave still pointing at the previous one.\n\nIf a later slave has no resolved neighbour, teql_resolve() hands the skb\nto neigh_event_send(), which queues it on that neighbour\u0027s arp_queue\nwith the stale skb-\u003edev. skb-\u003edev holds no reference, so deleting the\nprevious slave frees the net_device while the skb is still queued.\nWhatever runs next on that skb - arp_error_report() on timeout, or\nneigh_direct_output() -\u003e dev_queue_xmit() once the neighbour resolves -\ncauses a UAF like the one below:\n\nBUG: KASAN: slab-use-after-free in __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\nRead of size 4 at addr ffff888106e100b0 by task flood_packet/527\nCPU: 0 UID: 0 PID: 527 Comm: flood_packet Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n\u003cIRQ\u003e\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n? __pfx__raw_spin_lock_irqsave (./include/asm-generic/qrwlock.h:122 (discriminator 4))\n? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\nkasan_report (mm/kasan/report.c:595)\n? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\n__icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\n[...]\nipv4_link_failure (net/ipv4/route.c:1251 net/ipv4/route.c:1258)\n? __pfx_ipv4_link_failure (./include/linux/skbuff.h:4327)\n? _raw_write_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:1301 ./include/asm-generic/qrwlock.h:98 ./include/linux/rwlock_api_smp.h:230 kernel/locking/spinlock.c:304)\n? __pfx__raw_write_lock (kernel/locking/spinlock.c:175)\narp_error_report (./include/net/dst.h:438 net/ipv4/arp.c:296)\nneigh_invalidate (net/core/neighbour.c:1077)\nneigh_timer_handler (net/core/neighbour.c:1169)\n[...]\nAllocated by task 505:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\n__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:6905)\nalloc_netdev_mqs (net/core/dev.c:12055 (discriminator 2))\nrtnl_create_link (net/core/rtnetlink.c:3721)\nrtnl_newlink (net/core/rtnetlink.c:3903 net/core/rtnetlink.c:4044 net/core/rtnetlink.c:4159)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n[...]\nFreed by task 536:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)\ndevice_release (drivers/base/core.c:2636)\nkobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)\nnetdev_run_todo (net/core/dev.c:11756)\nrtnl_dellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3651)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n[...]\n\nFix this by restoring skb-\u003edev to the master at the end of each slave\u0027s\niteration."
    }
  ],
  "id": "CVE-2026-90071",
  "lastModified": "2026-10-19T09:18:55.723",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-17T17:16:56.073",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/00d8a387b23b7831ad9919256a6b9caaa10f19c3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/012559cf3c67ce8825a31d4f66b040b6fbaf775e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0cd75037948567193f7f5767176538822ce23873"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1360bc93f5be1be3cf937ebea667b3418dd30a79"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/96bc345a3f17543d0d92ada609e02198d6380e26"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/aa39a790d56b40bfcf3861653ceb46a3a113adb6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d453bf439ef230b5743afc25e194adacca8c6e43"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dc4b95b8fee95113587e93ca116356032d271371"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

CVE-2026-90071 (GCVE-0-2026-90071)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:05 – Updated: 2026-10-19 08:57

Title

net/sched: sch_teql: restore skb->dev on the slave failure path

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6639 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/1360bc93f5be1be3c…
https://git.kernel.org/stable/c/d453bf439ef230b57…
https://git.kernel.org/stable/c/012559cf3c67ce882…
https://git.kernel.org/stable/c/aa39a790d56b40bfc…
https://git.kernel.org/stable/c/00d8a387b23b7831a…
https://git.kernel.org/stable/c/96bc345a3f17543d0…
https://git.kernel.org/stable/c/0cd75037948567193…
https://git.kernel.org/stable/c/dc4b95b8fee951135…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 383493b9940e3d1b5517424081b3e072e20ec43c , < 1360bc93f5be1be3cf937ebea667b3418dd30a79 (git) Affected: 6b1f563d670162e188a0f2aec39c24b67b106e17 , < d453bf439ef230b5743afc25e194adacca8c6e43 (git) Affected: 57c153249143333bbf4ecf927bdf8aa2696ee397 , < 012559cf3c67ce8825a31d4f66b040b6fbaf775e (git) Affected: 59b06d8b9bdb6b64b3c534c18da68bce5ccd31be , < aa39a790d56b40bfcf3861653ceb46a3a113adb6 (git) Affected: 81a43e8005366f16e629d8c95dfe05beaa8d36a7 , < 00d8a387b23b7831ad9919256a6b9caaa10f19c3 (git) Affected: 0bad9c86edd22dec4df83c2b29872d66fd8a2ff4 , < 96bc345a3f17543d0d92ada609e02198d6380e26 (git) Affected: 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 , < 0cd75037948567193f7f5767176538822ce23873 (git) Affected: 0cc0c2e661af418bbf7074179ea5cfffc0a5c466 , < dc4b95b8fee95113587e93ca116356032d271371 (git) Affected: 21ea283c2750c8307aa35ee832b0951cc993c27d (git) Affected: 5.10.253 , < 5.10.270 (semver) Affected: 5.15.203 , < 5.15.221 (semver) Affected: 6.1.167 , < 6.1.188 (semver) Affected: 6.6.130 , < 6.6.157 (semver) Affected: 6.12.78 , < 6.12.110 (semver) Affected: 6.18.19 , < 6.18.52 (semver) Affected: 6.19.9 , < 6.20 (semver)
Linux	Linux	Affected: 7.0 Unaffected: 0 , < 7.0 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.110 , ≤ 6.12.* (semver) Unaffected: 6.18.52 , ≤ 6.18.* (semver) Unaffected: 7.2.6 , ≤ 7.2.* (semver) Unaffected: 7.3 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1360bc93f5be1be3cf937ebea667b3418dd30a79",
              "status": "affected",
              "version": "383493b9940e3d1b5517424081b3e072e20ec43c",
              "versionType": "git"
            },
            {
              "lessThan": "d453bf439ef230b5743afc25e194adacca8c6e43",
              "status": "affected",
              "version": "6b1f563d670162e188a0f2aec39c24b67b106e17",
              "versionType": "git"
            },
            {
              "lessThan": "012559cf3c67ce8825a31d4f66b040b6fbaf775e",
              "status": "affected",
              "version": "57c153249143333bbf4ecf927bdf8aa2696ee397",
              "versionType": "git"
            },
            {
              "lessThan": "aa39a790d56b40bfcf3861653ceb46a3a113adb6",
              "status": "affected",
              "version": "59b06d8b9bdb6b64b3c534c18da68bce5ccd31be",
              "versionType": "git"
            },
            {
              "lessThan": "00d8a387b23b7831ad9919256a6b9caaa10f19c3",
              "status": "affected",
              "version": "81a43e8005366f16e629d8c95dfe05beaa8d36a7",
              "versionType": "git"
            },
            {
              "lessThan": "96bc345a3f17543d0d92ada609e02198d6380e26",
              "status": "affected",
              "version": "0bad9c86edd22dec4df83c2b29872d66fd8a2ff4",
              "versionType": "git"
            },
            {
              "lessThan": "0cd75037948567193f7f5767176538822ce23873",
              "status": "affected",
              "version": "0cc0c2e661af418bbf7074179ea5cfffc0a5c466",
              "versionType": "git"
            },
            {
              "lessThan": "dc4b95b8fee95113587e93ca116356032d271371",
              "status": "affected",
              "version": "0cc0c2e661af418bbf7074179ea5cfffc0a5c466",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "21ea283c2750c8307aa35ee832b0951cc993c27d",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.270",
              "status": "affected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.221",
              "status": "affected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThan": "6.1.188",
              "status": "affected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12.110",
              "status": "affected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThan": "6.18.52",
              "status": "affected",
              "version": "6.18.19",
              "versionType": "semver"
            },
            {
              "lessThan": "6.20",
              "status": "affected",
              "version": "6.19.9",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_teql.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "7.0"
            },
            {
              "lessThan": "7.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "5.10.253",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15.203",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "6.1.167",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.130",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "6.12.78",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "6.18.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "7.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.19.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_teql: restore skb-\u003edev on the slave failure path\n\nteql_master_xmit() sets skb-\u003edev = slave before calling the slave\u0027s\nndo_start_xmit(), but never restores it when that transmit fails. The\nskb then walks on to the next slave still pointing at the previous one.\n\nIf a later slave has no resolved neighbour, teql_resolve() hands the skb\nto neigh_event_send(), which queues it on that neighbour\u0027s arp_queue\nwith the stale skb-\u003edev. skb-\u003edev holds no reference, so deleting the\nprevious slave frees the net_device while the skb is still queued.\nWhatever runs next on that skb - arp_error_report() on timeout, or\nneigh_direct_output() -\u003e dev_queue_xmit() once the neighbour resolves -\ncauses a UAF like the one below:\n\nBUG: KASAN: slab-use-after-free in __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\nRead of size 4 at addr ffff888106e100b0 by task flood_packet/527\nCPU: 0 UID: 0 PID: 527 Comm: flood_packet Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n\u003cIRQ\u003e\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n? __pfx__raw_spin_lock_irqsave (./include/asm-generic/qrwlock.h:122 (discriminator 4))\n? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\nkasan_report (mm/kasan/report.c:595)\n? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\n__icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\n[...]\nipv4_link_failure (net/ipv4/route.c:1251 net/ipv4/route.c:1258)\n? __pfx_ipv4_link_failure (./include/linux/skbuff.h:4327)\n? _raw_write_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:1301 ./include/asm-generic/qrwlock.h:98 ./include/linux/rwlock_api_smp.h:230 kernel/locking/spinlock.c:304)\n? __pfx__raw_write_lock (kernel/locking/spinlock.c:175)\narp_error_report (./include/net/dst.h:438 net/ipv4/arp.c:296)\nneigh_invalidate (net/core/neighbour.c:1077)\nneigh_timer_handler (net/core/neighbour.c:1169)\n[...]\nAllocated by task 505:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\n__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:6905)\nalloc_netdev_mqs (net/core/dev.c:12055 (discriminator 2))\nrtnl_create_link (net/core/rtnetlink.c:3721)\nrtnl_newlink (net/core/rtnetlink.c:3903 net/core/rtnetlink.c:4044 net/core/rtnetlink.c:4159)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n[...]\nFreed by task 536:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)\ndevice_release (drivers/base/core.c:2636)\nkobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)\nnetdev_run_todo (net/core/dev.c:11756)\nrtnl_dellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3651)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n[...]\n\nFix this by restoring skb-\u003edev to the master at the end of each slave\u0027s\niteration."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - teql_master_xmit() itself writes skb-\u003edev to the slave, and the UAF is completed by a local RTM_DELLINK (rtnl_dellink \u2192 netdev_run_todo) of that slave while the skb sits on another slave\u0027s arp_queue; the packet reaches teql_master_xmit via sendto/udp_sendmsg \u2192 ip_finish_output2 \u2192 __dev_queue_xmit on teql0, not via a remote protocol field.\nAC:L - The attacker chooses the slaves, sends on teql0 so teql_master_xmit() leaves skb-\u003edev on a failed ndo_start_xmit/netif_xmit_frozen_or_stopped slave, then teql_resolve()/neigh_event_send() queues that skb for an unresolved neighbour, then issues RTM_DELLINK; flood_packet plus an unanswered ARP destination make this repeatable without third-party timing.\nPR:L - RTM_NEWLINK, RTM_NEWQDISC (tc_modify_qdisc \u2192 teql_qdisc_init) and the freeing RTM_DELLINK all go through rtnetlink_rcv_msg(), which requires netlink_net_capable(skb, CAP_NET_ADMIN) against sock_net(skb-\u003esk)-\u003euser_ns; unshare -Urn grants that namespaced capability without init-namespace root.\nUI:N - The attacker alone creates the slaves, grafts the teql0 qdisc, injects packets into teql_master_xmit(), and deletes the stale skb-\u003edev slave with RTM_DELLINK; no other user must open a file, mount a volume, or otherwise act.\nS:U - The freed object is a kernel net_device from alloc_netdev_mqs()/rtnl_newlink, used later on the same host via skb-\u003edev in __icmp_send() or dev_queue_xmit(); this is in-kernel memory corruption, not a VM, IOMMU, or hypervisor boundary crossing.\nC:H - KASAN reports a slab-use-after-free read of the freed net_device in __icmp_send() (skb_in-\u003edev-\u003eflags) from arp_error_report(); the same dangling skb-\u003edev is consumed by neigh_direct_output() \u2192 dev_queue_xmit(), and reclaim of that slab object yields an arbitrary kernel read.\nI:H - Once the neighbour resolves, neigh_update_process_arp_queue() calls neigh_direct_output() \u2192 dev_queue_xmit() on the dangling skb-\u003edev, so a reclaimed net_device\u0027s netdev_ops (ndo_start_xmit) become attacker-controlled, giving an arbitrary kernel write and control-flow hijack.\nA:H - The reported path is neigh_timer_handler() \u2192 neigh_invalidate() \u2192 arp_error_report() \u2192 ipv4_link_failure() \u2192 __icmp_send() hitting a KASAN slab-use-after-free of the deleted slave net_device, which oopses/panics the kernel even without further exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:57:28.331Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1360bc93f5be1be3cf937ebea667b3418dd30a79"
        },
        {
          "url": "https://git.kernel.org/stable/c/d453bf439ef230b5743afc25e194adacca8c6e43"
        },
        {
          "url": "https://git.kernel.org/stable/c/012559cf3c67ce8825a31d4f66b040b6fbaf775e"
        },
        {
          "url": "https://git.kernel.org/stable/c/aa39a790d56b40bfcf3861653ceb46a3a113adb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/00d8a387b23b7831ad9919256a6b9caaa10f19c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/96bc345a3f17543d0d92ada609e02198d6380e26"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cd75037948567193f7f5767176538822ce23873"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc4b95b8fee95113587e93ca116356032d271371"
        }
      ],
      "title": "net/sched: sch_teql: restore skb-\u003edev on the slave failure path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90071",
    "datePublished": "2026-09-17T16:05:52.245Z",
    "dateReserved": "2026-09-11T19:38:34.784Z",
    "dateUpdated": "2026-10-19T08:57:28.331Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted