CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit

Q: What is the severity of CVE-2026-23449?

The severity of CVE-2026-23449 is high, with a score of 7.8.

Q: How do I fix CVE-2026-23449?

To fix CVE-2026-23449, you should apply the available patch from the Linux kernel.

Q: What type of vulnerability is CVE-2026-23449?

CVE-2026-23449 is classified as a double free vulnerability.

Q: What impact does CVE-2026-23449 have on systems?

CVE-2026-23449 can lead to system crashes when certain conditions are met.

Q: Which software is affected by CVE-2026-23449?

CVE-2026-23449 affects the Linux kernel.

Published Apr 3, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net/sched: teql: Fix double-free in teqlmasterxmit

Whenever a TEQL devices has a lockless Qdisc as root, qdiscreset should be called using the seqlock to avoid racing with the datapath. Failure to do so may cause crashes like the following:

[ 238.028993][ T318] BUG: KASAN: double-free in skbreleasedata (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task pocteqluafke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: pocteqlke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dumpstacklvl (lib/dumpstack.c:122) [ 238.029928][ T318] printreport (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skbreleasedata (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srsoaliasreturnthunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skbreleasedata (net/core/skbuff.c:1139) [ 238.029969][ T318] kasanreportinvalidfree (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skbreleasedata (net/core/skbuff.c:1139) [ 238.029989][ T318] checkslaballocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmemcachefree (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skbreleasedata (net/core/skbuff.c:1139) ... [ 238.030025][ T318] skskbreasondrop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifofastreset (./include/linux/ptrring.h:171 ./include/linux/ptrring.h:309 ./include/linux/skbarray.h:98 net/sched/schgeneric.c:827) [ 238.030039][ T318] ? srsoaliasreturnthunk (arch/x86/lib/retpoline.S:221) ... [ 238.030054][ T318] qdiscreset (net/sched/schgeneric.c:1034) [ 238.030062][ T318] teqldestroy (./include/linux/spinlock.h:395 net/sched/schteql.c:157) [ 238.030071][ T318] qdiscdestroy (./include/net/pktsched.h:328 net/sched/schgeneric.c:1077) [ 238.030077][ T318] qdiscgraft (net/sched/schapi.c:1062 net/sched/schapi.c:1053 net/sched/schapi.c:1159) [ 238.030089][ T318] ? pfxqdiscgraft (net/sched/schapi.c:1091) [ 238.030095][ T318] ? srsoaliasreturnthunk (arch/x86/lib/retpoline.S:221) [ 238.030102][ T318] ? srsoaliasreturnthunk (arch/x86/lib/retpoline.S:221) [ 238.030106][ T318] ? srsoaliasreturnthunk (arch/x86/lib/retpoline.S:221) [ 238.030114][ T318] tcgetqdisc (net/sched/schapi.c:1529 net/sched/schapi.c:1556) ... [ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s: [ 238.073392][ T318] kasansavestack (mm/kasan/common.c:58) [ 238.073884][ T318] kasansavetrack (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.074230][ T318] kasanslaballoc (mm/kasan/common.c:369) [ 238.074578][ T318] kmemcacheallocnodenoprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921) [ 238.076091][ T318] kmallocreserve (net/core/skbuff.c:616 (discriminator 107)) [ 238.076450][ T318] allocskb (net/core/skbuff.c:713) [ 238.076834][ T318] allocskbwithfrags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763) [ 238.077178][ T318] sockallocsendpskb (net/core/sock.c:2997) [ 238.077520][ T318] packetsendmsg (net/packet/afpacket.c:2926 net/packet/afpacket.c:3019 net/packet/afpacket.c:3108) [ 238.081469][ T318] [ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s: [ 238.082761][ T318] kasansavestack (mm/kasan/common.c:58) [ 238.083481][ T318] kasansavetrack (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.085348][ T318] kasansavefreeinfo (mm/kasan/generic.c:587 (discriminator 1)) [ 238.085900][ T318] kasanslabfree (mm/ ---truncated---

Affected Software

224 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=4.18<6.1.167

Linux Linux kernel>=6.2<6.6.130

Linux Linux kernel>=6.7<6.12.78

Linux Linux kernel>=6.13<6.18.20

Linux Linux kernel>=6.19<6.19.10

Linux Linux kernel=7.0-rc1

Linux Linux kernel=7.0-rc2

Linux Linux kernel=7.0-rc3

Linux Linux kernel=7.0-rc4

ubuntu/linux-hwe-edge*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4*

ubuntu/linux-azure*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4*

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4*

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4*

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4*

ubuntu/linux-oem*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4*

ubuntu/linux-raspi-5.4*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15*

ubuntu/linux-aws-5.8*

ubuntu/linux-azure*

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15*

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15*

ubuntu/linux-bluefield*

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15*

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15*

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm*

ubuntu/linux-ibm-5.15*

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15*

ubuntu/linux-iot*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency-hwe-5.15*

ubuntu/linux-nvidia-tegra-5.15*

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15*

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi*

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15*

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux*

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws*

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1061.64~22.04.1

6.8.0-1061.64~22.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1063.71~22.04.1

6.8.0-1063.71~22.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1062.69~22.04.1

6.8.0-1062.69~22.04.1

ubuntu/linux-gcp*

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1064.72~22.04.1

6.8.0-1064.72~22.04.1

ubuntu/linux-gke*

ubuntu/linux-gkeop*

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-hwe-6.8<6.8.0-136.136~22.04.1

6.8.0-136.136~22.04.1

ubuntu/linux-ibm*

ubuntu/linux-ibm-6.8<6.8.0-1061.62~22.04.1

6.8.0-1061.62~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg*

ubuntu/linux-kvm*

ubuntu/linux-lowlatency*

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-136.136.2~22.04.1

6.8.0-136.136.2~22.04.1

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8<6.8.0-1059.62~22.04.1

6.8.0-1059.62~22.04.1

ubuntu/linux-nvidia-tegra*

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle*

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1058.61~22.04.1

6.8.0-1058.61~22.04.1

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-riscv-6.8<6.8.0-136.136~22.04.3

6.8.0-136.136~22.04.3

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield*

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-realtime*

ubuntu/linux-realtime-6.8<6.8.1-1056.57~22.04.2

6.8.1-1056.57~22.04.2

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<6.8.0-136.136

6.8.0-136.136

ubuntu/linux-aws<6.8.0-1061.64

6.8.0-1061.64

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-azure<6.8.0-1063.71

6.8.0-1063.71

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-fde<6.8.0-1062.69

6.8.0-1062.69

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1064.72

6.8.0-1064.72

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gke<6.8.0-1059.67

6.8.0-1059.67

ubuntu/linux-gkeop<6.8.0-1046.50

6.8.0-1046.50

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-ibm<6.8.0-1061.62

6.8.0-1061.62

ubuntu/linux-lowlatency<6.8.0-136.136.2

6.8.0-136.136.2

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1059.62

6.8.0-1059.62

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-lowlatency<6.8.0-1059.62.1

6.8.0-1059.62.1

ubuntu/linux-nvidia-tegra<6.8.0-1030.31

6.8.0-1030.31

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1058.61

6.8.0-1058.61

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-raspi<6.8.0-1061.65

6.8.0-1061.65

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-xilinx<6.8.0-1033.34

6.8.0-1033.34

ubuntu/linux-bluefield<6.8.0-1028.33

6.8.0-1028.33

ubuntu/linux-raspi-realtime<6.8.0-2050.52

6.8.0-2050.52

ubuntu/linux-realtime<6.8.1-1056.57

6.8.1-1056.57

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1061.64+fips1

6.8.0-1061.64+fips1

ubuntu/linux-azure-fips<6.8.0-1063.71+fips2

6.8.0-1063.71+fips2

ubuntu/linux-fips<6.8.0-136.136+fips2

6.8.0-136.136+fips2

ubuntu/linux-gcp-fips<6.8.0-1064.72+fips1

6.8.0-1064.72+fips1

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-azure*

ubuntu/linux-azure-fde*

ubuntu/linux-gcp*

ubuntu/linux-oracle*

ubuntu/linux-raspi*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

debian/linux

6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72~22.04.1
Upgrade
Upgrade ubuntu/linux-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.1
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.62~22.04.1
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136.2~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62~22.04.1
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61~22.04.1
Upgrade
Upgrade ubuntu/linux-riscv-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136~22.04.3
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1056.57~22.04.2
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 6.8.0-1062.69
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.67
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1046.50
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.62
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136.2
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62
Upgrade
Upgrade ubuntu/linux-nvidia-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-1059.62.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1030.31
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1058.61
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.65
Upgrade
Upgrade ubuntu/linux-xilinx to a version that resolves this vulnerability.
Fixed in 6.8.0-1033.34
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1028.33
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2050.52
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1056.57
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1061.64+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1063.71+fips2
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-136.136+fips2
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1064.72+fips1
Compensating control
In the Linux kernel net/sched TEQL implementation, call qdisc_reset using the seq_lock whenever a TEQL device has a lockless Qdisc as its root, to avoid racing with the datapath and causing a double-free.

Event History

Apr 3, 2026

CVE Published

via MITRE·03:15 PM

Data Sourced

via MITRE·03:15 PM

DescriptionSeverity

Data Sourced

via OSV·04:16 PM

DescriptionSeverityAffected Software

Event

via OSV·04:16 PM

Data Sourced

via NVD·04:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4561-1

Frequently Asked Questions

What is the severity of CVE-2026-23449?

The severity of CVE-2026-23449 is high, with a score of 7.8.

How do I fix CVE-2026-23449?

To fix CVE-2026-23449, you should apply the available patch from the Linux kernel.

What type of vulnerability is CVE-2026-23449?

CVE-2026-23449 is classified as a double free vulnerability.

What impact does CVE-2026-23449 have on systems?

CVE-2026-23449 can lead to system crashes when certain conditions are met.

Which software is affected by CVE-2026-23449?

CVE-2026-23449 affects the Linux kernel.

CVE-2026-23449: net/sched: teql: Fix double-free in teql_master_xmit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-23449?

How do I fix CVE-2026-23449?

What type of vulnerability is CVE-2026-23449?

What impact does CVE-2026-23449 have on systems?

Which software is affected by CVE-2026-23449?

Company

Resources

Contact