CVE-2026-90071 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: restore skb->dev on the slave failure path
teql_master_xmit() sets skb->dev = slave before calling the slave's ndo_start_xmit(), but never restores it when that transmit fails. The skb then walks on to the next slave still pointing at the previous one.
If a later slave has no resolved neighbour, teql_resolve() hands the skb to neigh_event_send(), which queues it on that neighbour's arp_queue with the stale skb->dev. skb->dev holds no reference, so deleting the previous slave frees the net_device while the skb is still queued. Whatever runs next on that skb - arp_error_report() on timeout, or neigh_direct_output() -> dev_queue_xmit() once the neighbour resolves - causes a UAF like the one below:
BUG: KASAN: slab-use-after-free in __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) Read of size 4 at addr ffff888106e100b0 by task flood_packet/527 CPU: 0 UID: 0 PID: 527 Comm: flood_packet Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) ? __pfx__raw_spin_lock_irqsave (./include/asm-generic/qrwlock.h:122 (discriminator 4)) ? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) kasan_report (mm/kasan/report.c:595) ? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) __icmp_send (net/ipv4/icmp.c:914 (discriminator 2)) [...]
ipv4_link_failure (net/ipv4/route.c:1251 net/ipv4/route.c:1258) ? __pfx_ipv4_link_failure (./include/linux/skbuff.h:4327) ? _raw_write_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:1301 ./include/asm-generic/qrwlock.h:98 ./include/linux/rwlock_api_smp.h:230 kernel/locking/spinlock.c:304) ? __pfx__raw_write_lock (kernel/locking/spinlock.c:175) arp_error_report (./include/net/dst.h:438 net/ipv4/arp.c:296) neigh_invalidate (net/core/neighbour.c:1077) neigh_timer_handler (net/core/neighbour.c:1169) [...]
Allocated by task 505: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) __kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415) __kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:6905) alloc_netdev_mqs (net/core/dev.c:12055 (discriminator 2)) rtnl_create_link (net/core/rtnetlink.c:3721) rtnl_newlink (net/core/rtnetlink.c:3903 net/core/rtnetlink.c:4044 net/core/rtnetlink.c:4159) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) [...]
Freed by task 536: kasan_save_stack (mm/kasan/common.c:57) kasan_save_track (mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692) device_release (drivers/base/core.c:2636) kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737) netdev_run_todo (net/core/dev.c:11756) rtnl_dellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3651) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) [...]
Fix this by restoring skb->dev to the master at the end of each slave's iteration.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel networking subsystem contains a critical use-after-free vulnerability within the TEQL load balancing driver, specifically in the teql_master_xmit function located in net/sched/sch_teql.c. This flaw arises from improper management of socket buffer metadata during packet transmission attempts across multiple slave network interfaces. When transmitting packets, the driver iterates through available slave devices to find one capable of sending data. The code sets the skb->dev pointer to point at a specific slave device before invoking that slave's ndo_start_xmit function. However, if this initial transmit attempt fails for any reason, such as congestion or hardware errors, the function proceeds to try subsequent slaves without resetting the skb->dev field back to the master interface. Consequently, the socket buffer retains a reference to the previously attempted but failed slave device rather than being correctly associated with the current candidate or the master structure itself.
This incorrect state leads directly to a severe memory safety issue known as a use-after-free vulnerability. When a later slave in the iteration sequence lacks a resolved neighbor entry for the destination address, teql_resolve hands the socket buffer over to neigh_event_send. This function queues the packet onto that specific slave's ARP queue while still carrying the stale pointer to an earlier slave device. Crucially, this reference does not hold a strong reference count on the net_device structure. Therefore, if the administrator removes or unloads the driver for that initial failed slave interface, the kernel frees the memory associated with that network device object. The socket buffer remains queued in the neighbor subsystem of the later slave, but its dev pointer now references freed memory.
The exploitation potential becomes evident when the system attempts to process these stale packets. If the ARP resolution times out, the arp_error_report function is invoked on the queued packet. Alternatively, if the neighbor eventually resolves and transmission proceeds via neigh_direct_output leading into dev_queue_xmit, the kernel will attempt to access fields within the freed net_device structure. As evidenced by KASAN reports in affected versions like 7.2.0-rc6, this results in a slab-use-after-free error during operations such as sending ICMP link failure messages. This can lead to kernel panics, denial of service conditions where network functionality is disrupted, or potentially arbitrary code execution if an attacker can control the contents of the freed memory region and trigger specific code paths that interpret those values maliciously.
From a classification perspective, this vulnerability aligns with CWE-416 Use After Free, as it involves accessing memory after it has been released by the system. It also relates to CWE-20 Improper Input Validation in the context of how the driver handles state transitions between slave devices without ensuring data structure integrity. In terms of attack vectors and tactics, this flaw could be leveraged within ATT&CK techniques related to Defense Evasion or Impact, specifically through Denial of Service via resource exhaustion or system crash. The vulnerability highlights a common pitfall in kernel networking code where reference counting and pointer management are not rigorously maintained during error handling paths.
The resolution for this issue involves modifying the teql_master_xmit function to explicitly restore skb->dev to point back to the master interface at the end of each iteration over slave devices, regardless of whether the transmission attempt succeeded or failed. This ensures that if a packet is eventually queued on a different neighbor's ARP queue due to unresolved addresses, it does not carry a dangling pointer to an unrelated and potentially deallocated network device structure. Mitigation strategies for system administrators include applying kernel updates provided by their distribution vendors as soon as they become available. For environments where immediate patching is not feasible, restricting the ability of unprivileged users to create or destroy TEQL interfaces via netlink can reduce the attack surface, although complete mitigation requires addressing the underlying code defect in the driver logic itself.