CVE-2026-72390 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
The teql master->slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently from teql_master_xmit(), teql_dequeue(), teql_init() and teql_destroy() without holding any list lock or RCU protection.
[email protected] has demonstrated that the qdisc is freed after an RCU grace period, but teql_master_xmit() running on another CPU can still hold a stale pointer into the list, resulting in a slab-use-after-free:
BUG: KASAN: slab-use-after-free in teql_master_xmit+0xf0f/0x16b0 Read of size 8 at addr ffff888013fb0440 by task poc/332 Freed 512-byte region [ffff888013fb0400, ffff888013fb0600) (kmalloc-512)
The fix? Add a per-master slaves_lock spinlock that serializes all mutations of master->slaves and the NEXT_SLAVE() links in teql_destroy() and teql_qdisc_init(). teql_master_xmit() also takes the same slaves_lock around those updates. Annotate master->slaves and the per-slave ->next pointer with __rcu and use the appropriate RCU accessors everywhere they are touched: rcu_assign_pointer() on the writer side (under slaves_lock), rcu_dereference_protected() for the writer-side loads (also under slaves_lock), rcu_dereference_bh() for the loads in teql_master_xmit() and rtnl_dereference() for the loads in teql_master_open()/teql_master_mtu(), which run under RTNL. Pair this with rcu_read_lock_bh()/rcu_read_unlock_bh() around the list traversal in teql_master_xmit(), so that readers either observe a fully linked list or are deferred until the in-flight mutation completes. The two early-return paths in teql_master_xmit() are updated to release the RCU-bh read-side critical section before returning, since leaving it held would disable BH on that CPU for good.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described involves a race condition and use-after-free issue within the Linux kernel's traffic control subsystem, specifically in the teql (traffic equalizer) qdisc implementation. This flaw exists in the net/sched directory where the teql master qdisc manages multiple slave interfaces through a singly linked list of slaves. The vulnerability stems from inadequate synchronization mechanisms protecting concurrent access to the master->slaves list structure during modification operations.
The technical flaw manifests as a lack of proper locking mechanisms around the teql master->slaves list, which can be modified concurrently by multiple functions including teql_master_xmit(), teql_dequeue(), teql_init(), and teql_destroy(). These functions operate without holding any list lock or RCU protection, creating opportunities for simultaneous read and write operations that result in inconsistent data states. The vulnerability has been classified under CWE-362 as a race condition, specifically involving concurrent access to shared resources without proper synchronization.
The operational impact of this vulnerability is severe as demonstrated by the KASAN report showing a slab-use-after-free condition. When the qdisc is freed after an RCU grace period, but another CPU continues executing teql_master_xmit() with a stale pointer into the now-freed memory region, it results in a use-after-free scenario that can lead to system instability, potential privilege escalation, or denial of service conditions. The memory access pattern shows a read of size 8 occurring at address ffff888013fb0440 by task poc/332, indicating a direct memory access violation after the object has been freed.
The proposed fix implements comprehensive synchronization measures to address this vulnerability. A per-master slaves_lock spinlock is introduced to serialize all mutations of master->slaves and the NEXT_SLAVE() links across the affected functions. This approach follows ATT&CK technique T1068 by addressing privilege escalation paths through kernel memory corruption vulnerabilities. The solution employs proper RCU annotation with __rcu for the master->slaves and per-slave ->next pointers, utilizing appropriate accessors such as rcu_assign_pointer() for writers under slaves_lock protection, rcu_dereference_protected() for writer-side loads, and rcu_dereference_bh() for reader-side loads in teql_master_xmit(). Additionally, the fix implements rcu_read_lock_bh()/rcu_read_unlock_bh() around list traversal operations to ensure readers either observe fully consistent lists or are deferred until mutations complete. The implementation also addresses early return paths in teql_master_xmit() to properly release RCU-bh read-side critical sections, preventing indefinite disabling of bottom-half handlers on affected CPUs.
The mitigation strategy effectively addresses the root cause by implementing proper locking semantics and RCU protection patterns that prevent concurrent access violations while maintaining system performance. The solution aligns with kernel security best practices and follows established patterns for handling shared data structures in high-concurrency environments. This fix ensures that all modifications to the teql master->slaves list occur under proper synchronization, preventing the race condition that led to the use-after-free vulnerability while preserving the functionality of the traffic equalizer qdisc implementation.