Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system or potentially execute unauthorized code. The issue occurs when managing specific network traffic queuing components (TEQL), leading to memory corruption. This could result in a complete system service outage or a compromise of system integrity.
Technical details
A double-free vulnerability exists in the net/sched/sch_teql.c component of the Linux kernel. The root cause is a race condition between the network datapath (teql_master_xmit) and the control path (teql_destroy/qdisc_reset) when a TEQL device uses a lockless Qdisc as root. Specifically, qdisc_reset was being called without the necessary seq_lock, allowing a socket buffer (skb) to be freed twice during concurrent transmission and qdisc teardown. An attacker with local access can trigger this by repeatedly adding and deleting root qdiscs while simultaneously driving network traffic through a TEQL interface. The fix involves using dev_reset_queue, which correctly handles locking for both lockless and locked Qdiscs.
Affected products
- Linux Linux Kernel 4.18 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.20, 6.19 to 6.19.10, 7.0-rc1 to 7.0-rc4
Timeline
- 2026-03-15: patched: Initial patch authored by Jamal Hadi Salim
- 2026-04-03: advisory: CVE-2026-23449 published
References
- https://git.kernel.org/stable/c/21c89a0a8de7eadad8d385645a95b3233f23130e
- https://git.kernel.org/stable/c/4a233447b941db451ea5f5a0942cffd0f7f7eaae
- https://git.kernel.org/stable/c/4e8ebc4c18ea8213d28e6cb867d18fcc67daca21
- https://git.kernel.org/stable/c/66360460cab63c248ca5b1070a01c0c29133b960
- https://git.kernel.org/stable/c/afbc79a7770b230a9f24bd39271209d6b3682c5f
- https://git.kernel.org/stable/c/e9c66d3e7d8557b3308e55c613aa07254fe97611