Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-23449— net/sched: teql: Fix double-free in teql_master_xmit

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于竞争条件，可能导致双重释放。

CVSS 7.8 · High EPSS 0.13% · P2 Updated Oct 20, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1055 · Process Injection

Affected Version Matrix 14

Vendor	Product	Version Range	Status
Linux	Linux	`96009c7d500efdd5534e83b2e3eb2c58d4b137ae< 4e8ebc4c18ea8213d28e6cb867d18fcc67daca21`	affected
		`96009c7d500efdd5534e83b2e3eb2c58d4b137ae< 21c89a0a8de7eadad8d385645a95b3233f23130e`	affected
		`96009c7d500efdd5534e83b2e3eb2c58d4b137ae< afbc79a7770b230a9f24bd39271209d6b3682c5f`	affected
		`96009c7d500efdd5534e83b2e3eb2c58d4b137ae< e9c66d3e7d8557b3308e55c613aa07254fe97611`	affected
		`96009c7d500efdd5534e83b2e3eb2c58d4b137ae< 4a233447b941db451ea5f5a0942cffd0f7f7eaae`	affected
		`96009c7d500efdd5534e83b2e3eb2c58d4b137ae< 66360460cab63c248ca5b1070a01c0c29133b960`	affected
		`4.18`	affected
		`< 4.18`	unaffected
… +6 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23449

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

net/sched: teql: Fix double-free in teql_master_xmit

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: teql: Fix double-free in teql_master_xmit Whenever a TEQL devices has a lockless Qdisc as root, qdisc_reset should be called using the seq_lock to avoid racing with the datapath. Failure to do so may cause crashes like the following: [ 238.028993][ T318] BUG: KASAN: double-free in skb_release_data (net/core/skbuff.c:1139) [ 238.029328][ T318] Free of addr ffff88810c67ec00 by task poc_teql_uaf_ke/318 [ 238.029749][ T318] [ 238.029900][ T318] CPU: 3 UID: 0 PID: 318 Comm: poc_teql_ke Not tainted 7.0.0-rc3-00149-ge5b31d988a41 #704 PREEMPT(full) [ 238.029906][ T318] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 238.029910][ T318] Call Trace: [ 238.029913][ T318] <TASK> [ 238.029916][ T318] dump_stack_lvl (lib/dump_stack.c:122) [ 238.029928][ T318] print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) [ 238.029940][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029944][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.029957][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029969][ T318] kasan_report_invalid_free (mm/kasan/report.c:221 mm/kasan/report.c:563) [ 238.029979][ T318] ? skb_release_data (net/core/skbuff.c:1139) [ 238.029989][ T318] check_slab_allocation (mm/kasan/common.c:231) [ 238.029995][ T318] kmem_cache_free (mm/slub.c:2637 (discriminator 1) mm/slub.c:6168 (discriminator 1) mm/slub.c:6298 (discriminator 1)) [ 238.030004][ T318] skb_release_data (net/core/skbuff.c:1139) ... [ 238.030025][ T318] sk_skb_reason_drop (net/core/skbuff.c:1256) [ 238.030032][ T318] pfifo_fast_reset (./include/linux/ptr_ring.h:171 ./include/linux/ptr_ring.h:309 ./include/linux/skb_array.h:98 net/sched/sch_generic.c:827) [ 238.030039][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) ... [ 238.030054][ T318] qdisc_reset (net/sched/sch_generic.c:1034) [ 238.030062][ T318] teql_destroy (./include/linux/spinlock.h:395 net/sched/sch_teql.c:157) [ 238.030071][ T318] __qdisc_destroy (./include/net/pkt_sched.h:328 net/sched/sch_generic.c:1077) [ 238.030077][ T318] qdisc_graft (net/sched/sch_api.c:1062 net/sched/sch_api.c:1053 net/sched/sch_api.c:1159) [ 238.030089][ T318] ? __pfx_qdisc_graft (net/sched/sch_api.c:1091) [ 238.030095][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030102][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030106][ T318] ? srso_alias_return_thunk (arch/x86/lib/retpoline.S:221) [ 238.030114][ T318] tc_get_qdisc (net/sched/sch_api.c:1529 net/sched/sch_api.c:1556) ... [ 238.072958][ T318] Allocated by task 303 on cpu 5 at 238.026275s: [ 238.073392][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.073884][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.074230][ T318] __kasan_slab_alloc (mm/kasan/common.c:369) [ 238.074578][ T318] kmem_cache_alloc_node_noprof (./include/linux/kasan.h:253 mm/slub.c:4542 mm/slub.c:4869 mm/slub.c:4921) [ 238.076091][ T318] kmalloc_reserve (net/core/skbuff.c:616 (discriminator 107)) [ 238.076450][ T318] __alloc_skb (net/core/skbuff.c:713) [ 238.076834][ T318] alloc_skb_with_frags (./include/linux/skbuff.h:1383 net/core/skbuff.c:6763) [ 238.077178][ T318] sock_alloc_send_pskb (net/core/sock.c:2997) [ 238.077520][ T318] packet_sendmsg (net/packet/af_packet.c:2926 net/packet/af_packet.c:3019 net/packet/af_packet.c:3108) [ 238.081469][ T318] [ 238.081870][ T318] Freed by task 299 on cpu 1 at 238.028496s: [ 238.082761][ T318] kasan_save_stack (mm/kasan/common.c:58) [ 238.083481][ T318] kasan_save_track (mm/kasan/common.c:64 (discriminator 5) mm/kasan/common.c:79 (discriminator 5)) [ 238.085348][ T318] kasan_save_free_info (mm/kasan/generic.c:587 (discriminator 1)) [ 238.085900][ T318] __kasan_slab_free (mm/ ---truncated---

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Vulnerability Title

Linux kernel 安全漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于竞争条件，可能导致双重释放。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	96009c7d500efdd5534e83b2e3eb2c58d4b137ae ~ 4e8ebc4c18ea8213d28e6cb867d18fcc67daca21	-
Linux	Linux	4.18	-

II. Public POCs for CVE-2026-23449

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-23449

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2026-23449

Same Patch Batch · Linux · 2026-04-03 · 71 CVEs total

CVE-2026-23450	9.8 CRITICAL	net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
CVE-2026-23428	9.8 CRITICAL	ksmbd: fix use-after-free of share_conf in compound request
CVE-2026-23427	9.8 CRITICAL	ksmbd: fix use-after-free in durable v2 replay of active file handles
CVE-2026-31402	9.8 CRITICAL	nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
CVE-2026-23455	9.1 CRITICAL	netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
CVE-2026-23425	8.8 HIGH	KVM: arm64: Fix ID register initialization for non-protected pKVM guests
CVE-2026-23461	8.8 HIGH	Bluetooth: L2CAP: Fix use-after-free in l2cap_unregister_user
CVE-2026-23462	8.8 HIGH	Bluetooth: HIDP: Fix possible UAF
CVE-2026-23457	8.6 HIGH	netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
CVE-2026-23456	8.2 HIGH	netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
CVE-2026-23459	8.2 HIGH	ip_tunnel: adapt iptunnel_xmit_stats() to NETDEV_PCPU_STAT_DSTATS
CVE-2026-31393	8.1 HIGH	Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
CVE-2026-31392	8.1 HIGH	smb: client: fix krb5 mount with username option
CVE-2026-23466	7.8 HIGH	drm/xe: Open-code GGTT MMIO access protection
CVE-2026-23445	7.8 HIGH	igc: fix page fault in XDP TX timestamps handling
CVE-2026-31401	7.8 HIGH	HID: bpf: prevent buffer overflow in hid_hw_request
CVE-2026-23437	7.8 HIGH	net: shaper: protect late read accesses to the hierarchy
CVE-2026-23458	7.8 HIGH	netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
CVE-2026-23432	7.8 HIGH	mshv: Fix use-after-free in mshv_map_user_memory error path
CVE-2026-23444	7.8 HIGH	wifi: mac80211: always free skb on ieee80211_tx_prepare_skb() failure

Showing top 20 of 71 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux

V. Comments for CVE-2026-23449

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-23449— net/sched: teql: Fix double-free in teql_master_xmit

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 14

I. Basic Information for CVE-2026-23449

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2026-23449

III. Intelligence Information for CVE-2026-23449

Same Patch Batch · Linux · 2026-04-03 · 71 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2026-23449

Leave a comment