CVE-2026-99282

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99282", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.405Z", "datePublished": "2026-11-07T14:08:47.978Z", "dateUpdated": "2026-11-10T18:15:29.554Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-10T18:15:29.554Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_teql: fix use-after-free on lower qdisc drop\n\nThe issue: teql_master_xmit() tests the slave's ndo_start_xmit() return\nvalue against NETDEV_TX_OK alone. A slave that consumes the skb but\nreturns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated\nas if the skb were still owned, so the loop restores skb->dev and calls\n__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()\nfrom its ndo_start_xmit() (propagated since cbbef5e18307), and when the\nlower qdisc drops the packet that value is NET_XMIT_DROP after the skb\nhas been freed, giving a use-after-free in teql_master_xmit().\n\nThe Fix: test for consumption with dev_xmit_complete(), which accepts\nNETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that\nneed to distinguish consumed results from busy. Only NETDEV_TX_OK keeps\nthe packet counted in tx_packets/tx_bytes and advances the slave; a\nconsumed result that is neither a success nor NET_XMIT_CN ends the\nattempt and is charged to tx_dropped, so lower-qdisc drops are no longer\nreported as good transmits. NET_XMIT_CN is counted like success because\nit can accompany acceptance of the current packet: pfifo_head_drop drops\nthe old head, enqueues the current skb and returns NET_XMIT_CN.\n\nConditions to recreate the bug:\nWith CONFIG_NET_SCH_TEQL,\nCONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and\nlkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0\nand a teql0 root on lkrvlan0; bring teql0 up with an address and send one\nUDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower\nqdisc while holding a freed skb."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_teql.c"], "versions": [{"version": "572a9d7b6fc7f20f573664063324c086be310c42", "lessThan": "8d5f768780e26cb82c389219ae7fdb1cd7255421", "status": "affected", "versionType": "git"}, {"version": "572a9d7b6fc7f20f573664063324c086be310c42", "lessThan": "fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde", "status": "affected", "versionType": "git"}, {"version": "572a9d7b6fc7f20f573664063324c086be310c42", "lessThan": "2702ae318630787c640ec0d0403ffd9d95c43e9e", "status": "affected", "versionType": "git"}, {"version": "572a9d7b6fc7f20f573664063324c086be310c42", "lessThan": "782d6bb8f9b8e9d8591181662222bf74cd3ecf79", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/sch_teql.c"], "versions": [{"version": "2.6.33", "status": "affected"}, {"version": "0", "lessThan": "2.6.33", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.117", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.61", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3.2", "lessThanOrEqual": "7.3.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.4-rc1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "6.12.117"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "6.18.61"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "7.3.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.33", "versionEndExcluding": "7.4-rc1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8d5f768780e26cb82c389219ae7fdb1cd7255421"}, {"url": "https://git.kernel.org/stable/c/fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde"}, {"url": "https://git.kernel.org/stable/c/2702ae318630787c640ec0d0403ffd9d95c43e9e"}, {"url": "https://git.kernel.org/stable/c/782d6bb8f9b8e9d8591181662222bf74cd3ecf79"}], "title": "net/sched: sch_teql: fix use-after-free on lower qdisc drop", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/sch_teql.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8d5f768780e26cb82c389219ae7fdb1cd7255421", "status": "affected", "version": "572a9d7b6fc7f20f573664063324c086be310c42", "versionType": "git"}, {"lessThan": "fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde", "status": "affected", "version": "572a9d7b6fc7f20f573664063324c086be310c42", "versionType": "git"}, {"lessThan": "2702ae318630787c640ec0d0403ffd9d95c43e9e", "status": "affected", "version": "572a9d7b6fc7f20f573664063324c086be310c42", "versionType": "git"}, {"lessThan": "782d6bb8f9b8e9d8591181662222bf74cd3ecf79", "status": "affected", "version": "572a9d7b6fc7f20f573664063324c086be310c42", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/sch_teql.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.33"}, {"lessThan": "2.6.33", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.117", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.61", "versionType": "semver"}, {"lessThanOrEqual": "7.3.*", "status": "unaffected", "version": "7.3.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.4-rc1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_teql: fix use-after-free on lower qdisc drop\n\nThe issue: teql_master_xmit() tests the slave's ndo_start_xmit() return\nvalue against NETDEV_TX_OK alone. A slave that consumes the skb but\nreturns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated\nas if the skb were still owned, so the loop restores skb->dev and calls\n__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()\nfrom its ndo_start_xmit() (propagated since cbbef5e18307), and when the\nlower qdisc drops the packet that value is NET_XMIT_DROP after the skb\nhas been freed, giving a use-after-free in teql_master_xmit().\n\nThe Fix: test for consumption with dev_xmit_complete(), which accepts\nNETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that\nneed to distinguish consumed results from busy. Only NETDEV_TX_OK keeps\nthe packet counted in tx_packets/tx_bytes and advances the slave; a\nconsumed result that is neither a success nor NET_XMIT_CN ends the\nattempt and is charged to tx_dropped, so lower-qdisc drops are no longer\nreported as good transmits. NET_XMIT_CN is counted like success because\nit can accompany acceptance of the current packet: pfifo_head_drop drops\nthe old head, enqueues the current skb and returns NET_XMIT_CN.\n\nConditions to recreate the bug:\nWith CONFIG_NET_SCH_TEQL,\nCONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and\nlkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0\nand a teql0 root on lkrvlan0; bring teql0 up with an address and send one\nUDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower\nqdisc while holding a freed skb."}], "id": "CVE-2026-99282", "lastModified": "2026-11-10T19:22:31.583", "metrics": {}, "published": "2026-11-07T14:17:03.940", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2702ae318630787c640ec0d0403ffd9d95c43e9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/782d6bb8f9b8e9d8591181662222bf74cd3ecf79"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d5f768780e26cb82c389219ae7fdb1cd7255421"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Denial of Service via use-after-free in sch_teql", "id": "2568626", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2568626"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's Traffic Equalizer (sch_teql) network scheduler. This flaw allows an attacker to cause a Denial of Service (DoS) by transmitting network traffic through an affected network interface. During packet transmission, if a subordinate network device or lower queueing discipline drops a packet, the teql driver fails to recognize that the packet buffer was consumed and freed. Consequently, the kernel attempts to access the already freed buffer, resulting in a use-after-free condition and a system crash."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the sch_teql kernel module from loading by executing the following command as root:\n# echo \"install sch_teql /bin/true\" >> /etc/modprobe.d/disable-sch_teql.conf\nIf the module is currently loaded and not in use, remove it:\n# modprobe -r sch_teql\nWarning: A system reboot may be required if the module is actively in use and cannot be unloaded. Disabling this module prevents the use of the True Equalizer (TEQL) queueing discipline, which may affect network setups that rely on this feature."}, "name": "CVE-2026-99282", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:rhel_els:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:rhel_els:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-10", "product_name": "Red Hat OpenShift Container Platform 5"}, {"cpe": "cpe:/a:redhat:openshift:5", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 5"}], "public_date": "2026-11-07T14:08:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99282\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99282\nhttps://git.kernel.org/stable/c/2702ae318630787c640ec0d0403ffd9d95c43e9e\nhttps://git.kernel.org/stable/c/782d6bb8f9b8e9d8591181662222bf74cd3ecf79\nhttps://git.kernel.org/stable/c/fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde"], "statement": "This vulnerability is rated as Moderate severity for Red Hat because exploiting it requires local privileges to configure traffic control queueing disciplines and network interfaces, restricting the potential impact to a local denial of service. The True Equalizer (TEQL) scheduler is not configured by default in standard enterprise environments, substantially limiting exposure. In typical deployments, an unprivileged or remote attacker cannot trigger this condition without an administrative configuration linking TEQL with packet-dropping slave devices.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[572a9d7b6fc7f20f573664063324c086be310c42,fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[572a9d7b6fc7f20f573664063324c086be310c42,2702ae318630787c640ec0d0403ffd9d95c43e9e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[572a9d7b6fc7f20f573664063324c086be310c42,782d6bb8f9b8e9d8591181662222bf74cd3ecf79)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.33"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.33)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[572a9d7b6fc7f20f573664063324c086be310c42,fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[572a9d7b6fc7f20f573664063324c086be310c42,2702ae318630787c640ec0d0403ffd9d95c43e9e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[572a9d7b6fc7f20f573664063324c086be310c42,782d6bb8f9b8e9d8591181662222bf74cd3ecf79)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.33"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.33)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.61,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.3.2,7.4.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.4-rc1,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-11-07T15:30:07.506808+00:00", "updated": "2026-11-08T04:00:13.051829+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}