Executive brief
The Linux kernel's teql (trivial queuing layer) network scheduler contains a race condition that can cause the system to use freed memory during packet transmission. An attacker with local access could exploit this to crash the kernel or potentially execute code, disrupting network operations and system stability.
Technical details
The vulnerability is a use-after-free (UAF) in the teql qdisc's master->slaves linked list, which lacks synchronization when modified concurrently from multiple code paths (teql_master_xmit, teql_dequeue, teql_init, teql_destroy). The teql master structure is freed after an RCU grace period, but teql_master_xmit() running on another CPU can still hold a stale pointer into the list, leading to a slab-use-after-free detected by KASAN. The fix introduces a per-master slaves_lock spinlock to serialize all mutations of the list and adds proper RCU annotations (rcu_assign_pointer, rcu_dereference_protected, rcu_dereference_bh) with rcu_read_lock_bh/rcu_read_unlock_bh pairing around list traversals in teql_master_xmit to ensure readers observe a consistent list state.
Affected products
- Linux Linux kernel affected versions unknown, patch released
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: Fix committed to Linux kernel with slaves_lock synchronization and RCU annotations