UBUNTU-CVE-2026-72390: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: Introduce slaveslock to avoid race condition and UAF The teql master->slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teqlmasterxmit(), teqldequeue(), teqlinit() and teqldestroy() without holding any list lock or RCU protection. zdi-disclosures@trendmicro.com has demonstrated that the qdisc is freed after an RCU grace period, but teqlmasterxmit() running on another CPU can still hold a stale pointer into the list, resulting in a slab-use-after-free: BUG: KASAN: slab-use-after-free in teqlmasterxmit+0xf0f/0x16b0 Read of size 8 at addr ffff888013fb0440 by task poc/332 Freed 512-byte region [ffff888013fb0400, ffff888013fb0600) (kmalloc-512) The fix? Add a per-master slaveslock spinlock that serializes all mutations of master->slaves and the NEXTSLAVE() links in teqldestroy() and teqlqdiscinit(). teqlmasterxmit() also takes the same slaveslock around those updates. Annotate master->slaves and the per-slave ->next pointer with rcu and use the appropriate RCU accessors everywhere they are touched: rcuassignpointer() on the writer side (under slaveslock), rcudereferenceprotected() for the writer-side loads (also under slaveslock), rcudereferencebh() for the loads in teqlmasterxmit() and rtnldereference() for the loads in teqlmasteropen()/teqlmastermtu(), which run under RTNL. Pair this with rcureadlockbh()/rcureadunlockbh() around the list traversal in teqlmasterxmit(), so that readers either observe a fully linked list or are deferred until the in-flight mutation completes. The two early-return paths in teqlmasterxmit() are updated to release the RCU-bh read-side critical section before returning, since leaving it held would disable BH on that CPU for good.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 6.8.0-147.147 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70 - Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 6.8.0-1069.76 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 6.8.0-1066.74 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 6.8.0-1052.56 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 6.8.0-1067.68 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 6.8.0-147.147.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 6.8.0-1064.67 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 6.8.0-1033.38 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 6.8.1-1062.63 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1067.70+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-147.147+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 6.8.0-1071.79+fips1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In sch_teql, add a per-master slaves_lock spinlock and hold it when mutating master->slaves and the per-slave ->next/NEXT_SLAVE() links, including in teql_destroy(), teql_qdisc_init(), teql_master_xmit(), teql_dequeue(), and teql_init(). Annotate master->slaves and ->next with __rcu; use rcu_assign_pointer() for writer-side updates, rcu_dereference_protected() for writer-side loads under slaves_lock, rcu_dereference_bh() for teql_master_xmit() loads, and rtnl_dereference() for teql_master_open()/teql_master_mtu() loads. Wrap teql_master_xmit() list traversal in rcu_read_lock_bh()/rcu_read_unlock_bh(), including before both early returns.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems running the affected Ubuntu Linux kernel packages listed for this CVE are exposed when the TEQL network scheduler is in use. The listed package families include standard, AWS, Azure, GCP, FIPS, AWS FIPS, and Azure FIPS kernels.
What conditions are needed to exploit the flaw?
Exploitation requires local access, low privileges, and high attack complexity. No user interaction is required; the issue arises from concurrent access and modification of the TEQL master's slave list.
What is the potential impact?
A race can leave teql_master_xmit() using a stale pointer after a queueing discipline has been freed, causing a slab use-after-free. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability of the vulnerable system.
What should be done if patching cannot happen immediately?
The provided data does not specify a workaround. Reducing local low-privilege access and avoiding use of the TEQL scheduler can reduce exposure, but patching to a kernel containing the listed fix is the documented remediation.