CVE-2026-72390

Status: UPDATED  |  Advisory ID: CVE-2026-72390

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF

The teql master->slaves singly linked list is not protected against

multiple writes. It can be mod'ed concurently from teql_master_xmit(),

teql_dequeue(), teql_init() and teql_destroy() without holding any list

lock or RCU protection.

[email protected] has demonstrated that the qdisc is freed

after an RCU grace period, but teql_master_xmit() running on another

CPU can still hold a stale pointer into the list, resulting in a

slab-use-after-free:

BUG: KASAN: slab-use-after-free in teql_master_xmit+0xf0f/0x16b0

Read of size 8 at addr ffff888013fb0440 by task poc/332

Freed 512-byte region [ffff888013fb0400, ffff888013fb0600) (kmalloc-512)

The fix?

Add a per-master slaves_lock spinlock that serializes all mutations of

master->slaves and the NEXT_SLAVE() links in teql_destroy() and

teql_qdisc_init(). teql_master_xmit() also takes the same slaves_lock

around those updates.

Annotate master->slaves and the per-slave ->next pointer with __rcu and

use the appropriate RCU accessors everywhere they are touched:

rcu_assign_pointer() on the writer side (under slaves_lock),

rcu_dereference_protected() for the writer-side loads (also under

slaves_lock), rcu_dereference_bh() for the loads in teql_master_xmit() and

rtnl_dereference() for the loads in teql_master_open()/teql_master_mtu(),

which run under RTNL.

Pair this with rcu_read_lock_bh()/rcu_read_unlock_bh() around the list

traversal in teql_master_xmit(), so that readers either observe a fully

linked list or are deferred until the in-flight mutation completes. The two

early-return paths in teql_master_xmit() are updated to release the RCU-bh

read-side critical section before returning, since leaving it held would

disable BH on that CPU for good. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References