PT-2026-6144 · Linux+2 · Linux Kernel+2
Gangmin Kim
·
Published
2026-01-01
·
Updated
2026-05-26
·
CVE-2026-23074
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains an issue related to the
teql queuing discipline. The intended design of teql is for it to be used only as a root queuing discipline. The issue arises when teql is used as a child qdisc under certain conditions, specifically with QFQ and netem. A scenario involving delayed packets and updates to the lmax value can lead to a use-after-free condition due to incorrect queue length (qlen) management. Specifically, teql only updates the parent visible qlen at dequeue, and because peek always returns NULL, dequeue is never called, leaving the qlen at 0. This can cause a dangling pointer to be accessed when a packet is rescheduled. The vulnerable functions involved are qfq change class and qfq deact rm from agg.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu