CVE-2026-99282: net/sched: sch_teql: fix use-after-free on lower qdisc drop

In the Linux kernel, the following vulnerability has been resolved:

net/sched: schteql: fix use-after-free on lower qdisc drop

The issue: teqlmasterxmit() tests the slave's ndostartxmit() return value against NETDEVTXOK alone. A slave that consumes the skb but returns an error code (rc < NETXMITMASK, e.g. NETXMITDROP) is treated as if the skb were still owned, so the loop restores skb->dev and calls skbpull() on it. A VLAN slave returns the result of devqueuexmit() from its ndostartxmit() (propagated since cbbef5e18307), and when the lower qdisc drops the packet that value is NETXMITDROP after the skb has been freed, giving a use-after-free in teqlmasterxmit().

The Fix: test for consumption with devxmitcomplete(), which accepts NETDEVTXOK and every rc < NETXMITMASK, matching other callers that need to distinguish consumed results from busy. Only NETDEVTXOK keeps the packet counted in txpackets/txbytes and advances the slave; a consumed result that is neither a success nor NETXMITCN ends the attempt and is charged to txdropped, so lower-qdisc drops are no longer reported as good transmits. NETXMITCN is counted like success because it can accompany acceptance of the current packet: pfifoheaddrop drops the old head, enqueues the current skb and returns NETXMITCN.

Conditions to recreate the bug: With CONFIGNETSCHTEQL, CONFIGVLAN8021Q and CONFIGDUMMY enabled, add lkrdummy0 (dummy) and lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0 and a teql0 root on lkrvlan0; bring teql0 up with an address and send one UDP packet to it. The VLAN xmit returns NETXMITDROP from the lower qdisc while holding a freed skb.