CVE-2026-99282— net/sched: sch_teql: fix use-after-free on lower qdisc drop
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： net/sched: sch_teql: 修复因下层 qdisc 丢弃数据包导致的释放后使用（use-after-free）问题 问题描述： 函数仅将从属设备（slave）的 返回值与 进行比较。如果某个从属设备消耗了 skb（套接字缓冲区）但返回了错误码（即 ，例如 ），该函数会错误地认为 skb 的所有权仍属于调用者。因此，循环逻辑会恢复 并调用 处理该 skb。 对于 VLAN 从属设备，其 会返回 的结果（自提交 cbbef5e18307 起传播）。当下层 qd
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99282
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/sched: sch_teql: fix use-after-free on lower qdisc drop
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: fix use-after-free on lower qdisc drop
The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return
value against NETDEV_TX_OK alone. A slave that consumes the skb but
returns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated
as if the skb were still owned, so the loop restores skb->dev and calls
__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()
from its ndo_start_xmit() (propagated since cbbef5e18307), and when the
lower qdisc drops the packet that value is NET_XMIT_DROP after the skb
has been freed, giving a use-after-free in teql_master_xmit().
The Fix: test for consumption with dev_xmit_complete(), which accepts
NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that
need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps
the packet counted in tx_packets/tx_bytes and advances the slave; a
consumed result that is neither a success nor NET_XMIT_CN ends the
attempt and is charged to tx_dropped, so lower-qdisc drops are no longer
reported as good transmits. NET_XMIT_CN is counted like success because
it can accompany acceptance of the current packet: pfifo_head_drop drops
the old head, enqueues the current skb and returns NET_XMIT_CN.
Conditions to recreate the bug:
With CONFIG_NET_SCH_TEQL,
CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and
lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0
and a teql0 root on lkrvlan0; bring teql0 up with an address and send one
UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower
qdisc while holding a freed skb.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99282
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99282
请登录查看更多情报信息。
Other References for CVE-2026-99282 (3)
Same Patch Batch · Linux · 2026-11-07 · 12 CVEs total
| CVE-2026-99281 | tun: Require CAP_NET_ADMIN to attach to an ownerless device | |
| CVE-2026-99277 | ksmbd: hold a connection reference for each session channel | |
| CVE-2026-99279 | ksmbd: reclaim ended sessions on logoff and expiration | |
| CVE-2026-99278 | ksmbd: limit sessions on each connection | |
| CVE-2026-99280 | ksmbd: drain session procfs readers before dropping table references | |
| CVE-2026-99276 | ksmbd: defer connection scavenging while session locks are busy | |
| CVE-2026-99275 | smb: client: reject short SESSION_SETUP responses | |
| CVE-2026-99273 | ksmbd: reserve space for the UTF-16 terminator in stream info | |
| CVE-2026-99274 | smb: client: fix fiemap wild read on empty truncated response | |
| CVE-2026-99271 | ALSA: line6: Clear prev_fbuf on capture buffer release | |
| CVE-2026-99272 | smb: client: validate the data area in SMB2_read() |
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection -
CVE-2026-99280
ksmbd: drain session procfs readers before dropping table re
Same vendor: Linux
-
CVE-2026-99281
tun: Require CAP_NET_ADMIN to attach to an ownerless device -
CVE-2026-99277
ksmbd: hold a connection reference for each session channel -
CVE-2026-99279
ksmbd: reclaim ended sessions on logoff and expiration -
CVE-2026-99278
ksmbd: limit sessions on each connection -
CVE-2026-99280
ksmbd: drain session procfs readers before dropping table re