CVE-2026-90071

A flaw was found in the Linux kernel's network scheduler component (sch_teql). An issue exists where the skb->dev pointer is not correctly restored after a slave device transmit failure. This can result in a Use-After-Free (UAF) vulnerability if the associated network device is subsequently freed while the packet is still queued. A remote attacker could exploit this to trigger a kernel crash, leading to a denial of service.

A moderate impact use-after-free flaw was found in the Linux kernel's network scheduler, in the trivial link equalizer (TEQL) qdisc, sch_teql. When teql_master_xmit() transmits a packet on a slave device, it sets skb->dev to that slave but does not restore the pointer when the slave's transmit fails. The packet then moves on to the next slave still referencing the previous device, and if that slave has no resolved neighbour, the packet is queued on that neighbour's ARP queue with the stale skb->dev. Because skb->dev does not hold a reference to the device, deleting the previous slave frees its net_device while the packet is still queued; the use-after-free is triggered when the queued packet is later processed, for example by arp_error_report() on neighbour timeout or by dev_queue_xmit() once the neighbour resolves, which can result in a kernel crash and denial of service. Exploiting this flaw requires the ability to configure the TEQL qdisc and its slave devices, such as via rtnetlink, together with a specific sequence of a slave transmit failure, an unresolved neighbour, and deletion of the previously used slave device. Red Hat rates this flaw as moderate impact with high attack complexity, whereas the upstream CVE.org record scores it 7.8 (important); this difference reflects the local privileges and precise event sequence required for exploitation. All currently assessed Red Hat products, including Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform, are marked not affected because the vulnerable code is not present in the shipped kernels, and the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is recorded as out of support (OOSS).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.