CVE-2026-90071: net/sched: sch_teql: restore skb->dev on the slave failure path
In the Linux kernel, the following vulnerability has been resolved:
net/sched: schteql: restore skb->dev on the slave failure path
teqlmasterxmit() sets skb->dev = slave before calling the slave's ndostartxmit(), but never restores it when that transmit fails. The skb then walks on to the next slave still pointing at the previous one.
If a later slave has no resolved neighbour, teqlresolve() hands the skb to neigheventsend(), which queues it on that neighbour's arpqueue with the stale skb->dev. skb->dev holds no reference, so deleting the previous slave frees the netdevice while the skb is still queued. Whatever runs next on that skb - arperrorreport() on timeout, or neighdirectoutput() -> devqueuexmit() once the neighbour resolves - causes a UAF like the one below:
BUG: KASAN: slab-use-after-free in icmpsend (net/ipv4/icmp.c:914 (discriminator 2)) Read of size 4 at addr ffff888106e100b0 by task floodpacket/527 CPU: 0 UID: 0 PID: 527 Comm: floodpacket Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, archcaps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dumpstacklvl (lib/dumpstack.c:94 lib/dumpstack.c:120) printreport (mm/kasan/report.c:378 mm/kasan/report.c:482) ? pfxrawspinlockirqsave (./include/asm-generic/qrwlock.h:122 (discriminator 4)) ? icmpsend (net/ipv4/icmp.c:914 (discriminator 2)) kasanreport (mm/kasan/report.c:595) ? icmpsend (net/ipv4/icmp.c:914 (discriminator 2)) icmpsend (net/ipv4/icmp.c:914 (discriminator 2)) [...] ipv4linkfailure (net/ipv4/route.c:1251 net/ipv4/route.c:1258) ? pfxipv4linkfailure (./include/linux/skbuff.h:4327) ? rawwritelock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:1301 ./include/asm-generic/qrwlock.h:98 ./include/linux/rwlockapismp.h:230 kernel/locking/spinlock.c:304) ? pfxrawwritelock (kernel/locking/spinlock.c:175) arperrorreport (./include/net/dst.h:438 net/ipv4/arp.c:296) neighinvalidate (net/core/neighbour.c:1077) neightimerhandler (net/core/neighbour.c:1169) [...] Allocated by task 505: kasansavestack (mm/kasan/common.c:57) kasansavetrack (mm/kasan/common.c:78) kasankmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) kvmallocnodenoprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:6905) allocnetdevmqs (net/core/dev.c:12055 (discriminator 2)) rtnlcreatelink (net/core/rtnetlink.c:3721) rtnlnewlink (net/core/rtnetlink.c:3903 net/core/rtnetlink.c:4044 net/core/rtnetlink.c:4159) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076) [...] Freed by task 536: kasansavestack (mm/kasan/common.c:57) kasansavetrack (mm/kasan/common.c:78) kasansavefreeinfo (mm/kasan/generic.c:584) kasanslabfree (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692) devicerelease (drivers/base/core.c:2636) kobjectput (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737) netdevruntodo (net/core/dev.c:11756) rtnldellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3651) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076) [...]
Fix this by restoring skb->dev to the master at the end of each slave's iteration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1124.133 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In net/sched/sch_teql, update teql_master_xmit() to restore skb->dev to the master at the end of each slave iteration, including the slave transmit failure path, before the skb can proceed to another slave.
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
Traffic must be transmitted through the sch_teql scheduler such that one slave transmit fails, a later slave lacks a resolved neighbour, and the earlier slave is then deleted while the packet remains queued on the later neighbour's ARP queue. The issue can subsequently trigger when the queued packet is processed after neighbour timeout or resolution.
Which systems are realistically exposed?
Systems using the Linux kernel's sch_teql traffic scheduler with multiple slave devices are exposed when the described failed-transmit, unresolved-neighbour, and slave-deletion sequence can occur. The provided information does not establish that systems not using sch_teql are affected.
What can be done if the fix cannot be deployed immediately?
Avoid deleting a TEQL slave device while packets may remain queued for unresolved neighbours after a transmit failure. Reducing or avoiding use of sch_teql configurations involving multiple slaves and unresolved neighbour traffic also avoids the described trigger path.
How can an affected system manifest the issue?
The vulnerability can produce a kernel use-after-free when a queued packet is later handled, including through arp_error_report() after neighbour timeout or through neigh_direct_output() and dev_queue_xmit() after neighbour resolution. The report includes a KASAN slab-use-after-free observed in __icmp_send.