CVE-2026-72390
Received Received - Intake

Race Condition and UAF in Linux Kernel's sch_teql

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF The teql master->slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teql_master_xmit(), teql_dequeue(), teql_init() and teql_destroy() without holding any list lock or RCU protection. zdi-disclosures@trendmicro.com has demonstrated that the qdisc is freed after an RCU grace period, but teql_master_xmit() running on another CPU can still hold a stale pointer into the list, resulting in a slab-use-after-free: BUG: KASAN: slab-use-after-free in teql_master_xmit+0xf0f/0x16b0 Read of size 8 at addr ffff888013fb0440 by task poc/332 Freed 512-byte region [ffff888013fb0400, ffff888013fb0600) (kmalloc-512) The fix? Add a per-master slaves_lock spinlock that serializes all mutations of master->slaves and the NEXT_SLAVE() links in teql_destroy() and teql_qdisc_init(). teql_master_xmit() also takes the same slaves_lock around those updates. Annotate master->slaves and the per-slave ->next pointer with __rcu and use the appropriate RCU accessors everywhere they are touched: rcu_assign_pointer() on the writer side (under slaves_lock), rcu_dereference_protected() for the writer-side loads (also under slaves_lock), rcu_dereference_bh() for the loads in teql_master_xmit() and rtnl_dereference() for the loads in teql_master_open()/teql_master_mtu(), which run under RTNL. Pair this with rcu_read_lock_bh()/rcu_read_unlock_bh() around the list traversal in teql_master_xmit(), so that readers either observe a fully linked list or are deferred until the in-flight mutation completes. The two early-return paths in teql_master_xmit() are updated to release the RCU-bh read-side critical section before returning, since leaving it held would disable BH on that CPU for good.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72390
EUVD
EUVD-2026-59289

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's net/sched sch_teql module. It occurs due to a race condition where the teql master->slaves list is modified without proper locking, allowing concurrent access from multiple functions like teql_master_xmit() and teql_dequeue(). This can lead to a slab-use-after-free when a stale pointer is accessed after the memory is freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's net/sched sch_teql module and involves a race condition leading to a use-after-free. Detection requires checking kernel logs for KASAN reports or slab-use-after-free errors related to teql_master_xmit. Monitor system logs for crashes or kernel warnings about slab corruption.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. It may lead to system crashes, data corruption, or unauthorized access depending on the attacker's capabilities and system configuration.

Mitigation Strategies

Apply the kernel patch that introduces the slaves_lock spinlock and RCU annotations to the sch_teql module. Update to a Linux kernel version that includes this fix. If immediate patching is not possible, disable the teql qdisc module by blacklisting it or recompiling the kernel without sch_teql support.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72390. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart