{"id":"CVE-2026-99282","kind":"vulnerability","aliases":["CVE-2026-99282"],"related":[],"title":"Linux kernel: traffic-control drop path lets a packet use freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_teql: fix use-after-free on lower qdisc drop\n\nThe issue: teql_master_xmit() tests the slave's ndo_start_xmit() return\nvalue against NETDEV_TX_OK alone. A slave that consumes the skb but\nreturns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated\nas if the skb were still owned, so the loop restores skb->dev and calls\n__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()\nfrom its ndo_start_xmit() (propagated since cbbef5e18307), and when the\nlower qdisc drops the packet that value is NET_XMIT_DROP after the skb\nhas been freed, giving a use-after-free in teql_master_xmit().\n\nThe Fix: test for consumption with dev_xmit_complete(), which accepts\nNETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that\nneed to distinguish consumed results from busy. Only NETDEV_TX_OK keeps\nthe packet counted in tx_packets/tx_bytes and advances the slave; a\nconsumed result that is neither a success nor NET_XMIT_CN ends the\nattempt and is charged to tx_dropped, so lower-qdisc drops are no longer\nreported as good transmits. NET_XMIT_CN is counted like success because\nit can accompany acceptance of the current packet: pfifo_head_drop drops\nthe old head, enqueues the current skb and returns NET_XMIT_CN.\n\nConditions to recreate the bug:\nWith CONFIG_NET_SCH_TEQL,\nCONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and\nlkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0\nand a teql0 root on lkrvlan0; bring teql0 up with an address and send one\nUDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower\nqdisc while holding a freed skb.","summary":"In the Linux kernel's teql traffic-control scheduler, a dropped packet on a VLAN slave can be used after it has been freed. The sources do not state what an attacker can gain from this.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","networking","runtime","vlan"],"not_affected_if":["default-config","teql-not-configured"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T14:17:03+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","triaged_at":"2026-11-07T14:49:45+00:00","updated_at":"2026-11-07T14:49:45+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-07T14:49:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: traffic-control drop path lets a packet use freed memory","impact":"high","summary":"In the Linux kernel's teql traffic-control scheduler, a dropped packet on a VLAN slave can be used after it has been freed. The sources do not state what an attacker can gain from this.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","networking","vlan"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel networking code","analyst_note":"Check the NVD entry and the kernel stable commit for affected version ranges, fixed versions and the attacker's reach.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["teql-not-configured","default-config"],"who_is_affected":"Systems running a Linux kernel with CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, with teql devices configured over VLAN interfaces; the sources give the reproduction conditions but not the affected kernel versions. Systems without teql configured are not described as exposed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000726,"input_tokens":4876,"output_tokens":477,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99282':16A,19A '0':332C '37':325C '8021q':313C 'accept':200C,280C 'accompani':279C 'add':318C 'address':347C 'advanc':233C 'alon':101C 'attack':58B 'attempt':250C 'bring':342C 'bug':305C 'busi':220C 'call':137C 'caller':212C 'cbbef5e18307':159C 'charg':253C 'cn':247C,271C,300C 'code':112C 'complet':198C 'condit':301C 'config':307C,311C,315C 'consum':105C,217C,237C 'consumpt':194C 'control':5A,34B 'count':228C,273C 'current':283C,294C 'cve':14A,17A 'dev':135C,149C,196C 'distinguish':216C 'drop':6A,37B,82C,120C,165C,173C,256C,261C,287C,288C,361C 'dummi':316C,320C 'e.g':117C 'enabl':317C 'end':248C 'enqueu':292C 'error':111C 'everi':205C 'fix':74C,191C 'follow':66C 'free':78C,185C 'freed':12A,50B,179C,369C 'gain':60B 'give':180C 'good':267C 'head':286C,291C 'hold':367C 'id':324C 'issu':84C 'keep':225C 'kernel':2A,22B,29B,64C 'let':8A 'like':274C 'limit':331C 'linux':1A,21B,28B,63C 'linux-kernel':20B 'lkrdummy0':319C,327C,335C 'lkrvlan0':322C,341C 'longer':264C 'loop':132C 'lower':80C,163C,259C,364C 'lower-qdisc':258C 'mask':116C,209C 'master':86C,188C 'match':210C 'memori':13A 'ndo':92C,154C 'need':214C 'neither':241C 'net':114C,118C,171C,207C,245C,269C,298C,308C,359C 'net/sched':71C 'netdev':98C,201C,222C 'network':23B 'ok':100C,203C,224C 'old':290C 'one':350C 'own':129C 'packet':10A,38B,167C,227C,284C,352C 'packets/tx_bytes':231C 'path':7A 'pfifo':285C,330C 'propag':157C 'pull':139C 'qdisc':81C,164C,260C,365C 'queue':150C 'rc':113C,206C 'recreat':303C 'report':265C 'resolv':70C 'restor':133C 'result':147C,218C,238C 'return':95C,109C,145C,297C,358C 'root':333C,339C 'runtim':24B 'sch':72C,309C 'schedul':35B 'send':349C 'set':328C 'sinc':158C 'skb':107C,126C,134C,138C,176C,295C,370C 'slave':42B,90C,103C,144C,235C 'sourc':52B 'start':93C,155C 'state':55B 'still':128C 'success':243C,275C 'teql':31B,73C,85C,187C,310C 'teql0':338C,343C 'test':88C,192C 'traffic':4A,33B 'traffic-control':3A,32B 'transmit':268C 'treat':122C 'tx':99C,202C,223C,230C,255C 'udp':351C 'use':11A,45B,76C,183C 'use-after-fre':75C,182C 'valu':96C,169C 'vlan':25B,41B,143C,312C,323C,356C 'vulner':67C 'xmit':87C,94C,115C,119C,151C,156C,172C,189C,197C,208C,246C,270C,299C,357C,360C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, with teql devices configured over VLAN interfaces; the sources give the reproduction conditions but not the affected kernel versions. Systems without teql configured are not described as exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linuxkernel","networking","runtime","unknown","vlan"],"campaign_type":null,"search_a":"'-2026':15A,18A '-99282':16A,19A 'control':5A 'cve':14A,17A 'drop':6A 'freed':12A 'kernel':2A 'let':8A 'linux':1A 'memori':13A 'packet':10A 'path':7A 'traffic':4A 'traffic-control':3A 'use':11A","search_b":"'attack':58B 'control':34B 'drop':37B 'freed':50B 'gain':60B 'kernel':22B,29B 'linux':21B,28B 'linux-kernel':20B 'network':23B 'packet':38B 'runtim':24B 'schedul':35B 'slave':42B 'sourc':52B 'state':55B 'teql':31B 'traffic':33B 'traffic-control':32B 'use':45B 'vlan':25B,41B","search_c":"'0':332C '37':325C '8021q':313C 'accept':200C,280C 'accompani':279C 'add':318C 'address':347C 'advanc':233C 'alon':101C 'attempt':250C 'bring':342C 'bug':305C 'busi':220C 'call':137C 'caller':212C 'cbbef5e18307':159C 'charg':253C 'cn':247C,271C,300C 'code':112C 'complet':198C 'condit':301C 'config':307C,311C,315C 'consum':105C,217C,237C 'consumpt':194C 'count':228C,273C 'current':283C,294C 'dev':135C,149C,196C 'distinguish':216C 'drop':82C,120C,165C,173C,256C,261C,287C,288C,361C 'dummi':316C,320C 'e.g':117C 'enabl':317C 'end':248C 'enqueu':292C 'error':111C 'everi':205C 'fix':74C,191C 'follow':66C 'free':78C,185C 'freed':179C,369C 'give':180C 'good':267C 'head':286C,291C 'hold':367C 'id':324C 'issu':84C 'keep':225C 'kernel':64C 'like':274C 'limit':331C 'linux':63C 'lkrdummy0':319C,327C,335C 'lkrvlan0':322C,341C 'longer':264C 'loop':132C 'lower':80C,163C,259C,364C 'lower-qdisc':258C 'mask':116C,209C 'master':86C,188C 'match':210C 'ndo':92C,154C 'need':214C 'neither':241C 'net':114C,118C,171C,207C,245C,269C,298C,308C,359C 'net/sched':71C 'netdev':98C,201C,222C 'ok':100C,203C,224C 'old':290C 'one':350C 'own':129C 'packet':167C,227C,284C,352C 'packets/tx_bytes':231C 'pfifo':285C,330C 'propag':157C 'pull':139C 'qdisc':81C,164C,260C,365C 'queue':150C 'rc':113C,206C 'recreat':303C 'report':265C 'resolv':70C 'restor':133C 'result':147C,218C,238C 'return':95C,109C,145C,297C,358C 'root':333C,339C 'sch':72C,309C 'send':349C 'set':328C 'sinc':158C 'skb':107C,126C,134C,138C,176C,295C,370C 'slave':90C,103C,144C,235C 'start':93C,155C 'still':128C 'success':243C,275C 'teql':73C,85C,187C,310C 'teql0':338C,343C 'test':88C,192C 'transmit':268C 'treat':122C 'tx':99C,202C,223C,230C,255C 'udp':351C 'use':76C,183C 'use-after-fre':75C,182C 'valu':96C,169C 'vlan':143C,312C,323C,356C 'vulner':67C 'xmit':87C,94C,115C,119C,151C,156C,172C,189C,197C,208C,246C,270C,299C,357C,360C","first_public_at":"2026-11-07T14:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99282","severity":null,"published_at":"2026-11-07T14:17:03+00:00","modified_at":"2026-11-07T14:17:03+00:00","first_seen_at":"2026-11-07T14:47:40+00:00","fetched_at":"2026-11-07T14:47:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}