Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when a specific network traffic control component (teql) is used in a way it wasn't designed for, leading to memory corruption. This could impact system availability and the integrity of operations on affected Linux servers.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's net/sched subsystem due to the teql (True Link Equalizer) qdisc not being restricted to the root position. When teql is used as a child qdisc (e.g., under QFQ), it fails to correctly update the parent's visible queue length (sch->q.qlen) during enqueue operations because it only updates this value during dequeue. Since teql's 'peek' operation always returns NULL, certain classful qdiscs like QFQ may never call dequeue, leaving the queue length at zero. This inconsistency causes qfq_change_class to fail to deactivate a class while still freeing its pointers, resulting in a UAF when packets are later rescheduled. The fix enforces that teql can only be initialized as a root qdisc.
Affected products
- Linux Linux Kernel 2.6.12-rc2 to 6.13
Timeline
- 2026-01-14: patched: Initial patch submitted to kernel mailing lists
- 2026-02-04: advisory: CVE published
References
- https://git.kernel.org/stable/c/0686bedfed34155520f3f735cbf3210cb9044380
- https://git.kernel.org/stable/c/16ed73c1282d376b956bff23e5139add061767ba
- https://git.kernel.org/stable/c/4c7e8aa71c9232cba84c289b4b56cba80b280841
- https://git.kernel.org/stable/c/50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b
- https://git.kernel.org/stable/c/73d970ff0eddd874a84c953387c7f4464b705fc6
- https://git.kernel.org/stable/c/ae810e6a8ac4fe25042e6825d2a401207a2e41fb
- https://git.kernel.org/stable/c/dad49a67c2d817bfec98e6e45121b351e3a0202c