CVE-2026-72390

A flaw was found in the Linux kernel's sch_teql module. The teql master->slaves linked list, which manages network traffic queues, is not adequately protected against simultaneous modifications. This lack of protection can lead to a race condition, allowing a local attacker to trigger a Use-After-Free (UAF) vulnerability. A successful exploit could result in memory corruption, potentially leading to a denial of service or arbitrary code execution.

This vulnerability is evaluated as having a Moderate impact for Red Hat products because triggering the issue requires local privileges to manipulate network scheduling configurations, preventing direct remote exploitation. The sch_teql (traffic equalizer) queueing discipline is not utilized by default in standard Red Hat Enterprise Linux deployments and requires dedicated network setup. Consequently, successful exploitation is constrained to environments where this specific network scheduler is explicitly configured and local users possess permissions to modify network queue parameters.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.