CVE-2026-90071

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_teql: restore skb->dev on the slave failure path

teql_master_xmit() sets skb->dev = slave before calling the slave's

ndo_start_xmit(), but never restores it when that transmit fails. The

skb then walks on to the next slave still pointing at the previous one.

If a later slave has no resolved neighbour, teql_resolve() hands the skb

to neigh_event_send(), which queues it on that neighbour's arp_queue

with the stale skb->dev. skb->dev holds no reference, so deleting the

previous slave frees the net_device while the skb is still queued.

Whatever runs next on that skb - arp_error_report() on timeout, or

neigh_direct_output() -> dev_queue_xmit() once the neighbour resolves -

causes a UAF like the one below:

BUG: KASAN: slab-use-after-free in __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))

Read of size 4 at addr ffff888106e100b0 by task flood_packet/527

CPU: 0 UID: 0 PID: 527 Comm: flood_packet Not taint

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References