CVE-2026-72390 Linux CVE debrief

Who should care

Linux kernel developers and users who rely on the sch_teql module should be aware of this vulnerability and take necessary precautions to protect their systems. This includes reviewing the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Affected operators, platforms, and vulnerability-management teams should prioritize patching or mitigating this vulnerability to prevent potential exploitation. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, they should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. This vulnerability affects Linux kernel deployments that use the sch_teql module, and its exploitation could lead to a slab-use-after-free error, potentially allowing an attacker to execute arbitrary code or cause a denial-of-service condition. Therefore, it is essential for Linux kernel developers and users to apply the kernel patch that introduces the slaves_lock spinlock and use the appropriate RCU accessors for master->slaves and per-slave ->next pointer. They should also annotate master->slaves and per-slave ->next pointer with __rcu to prevent similar vulnerabilities in the future. Furthermore, they should review the vulnerability's impact on their specific use cases and ensure that their systems are properly configured to prevent exploitation. By taking these steps, Linux kernel developers and users can help prevent potential attacks and ensure the security of their systems. The vulnerability's resolution involves introducing a per-master slaves_lock spinlock to serialize all mutations of master->slaves and the NEXT_SLAVE() links. This fix also annotates master->slaves and the per-slave ->next pointer with __rcu and uses the appropriate RCU accessors. Overall, Linux kernel developers and users who rely on the sch_teql module must take immediate action to address this vulnerability and prevent potential exploitation. This includes applying the kernel patch, reviewing compensating 260

Technical summary

The teql master->slaves list is not protected against multiple writes, allowing for concurrent modification without holding a list lock or RCU protection. This can lead to a slab-use-after-free error when teql_master_xmit() holds a stale pointer into the list after the qdisc has been freed. The fix introduces a per-master slaves_lock spinlock to serialize all mutations of master->slaves and the NEXT_SLAVE() links.

Defensive priority

High

Recommended defensive actions

• Apply the kernel patch that introduces the slaves_lock spinlock
• Use the appropriate RCU accessors for master->slaves and per-slave ->next pointer
• Annotate master->slaves and per-slave ->next pointer with __rcu
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by introducing a per-master slaves_lock spinlock to serialize all mutations of master->slaves and the NEXT_SLAVE() links. The fix also annotates master->slaves and the per-slave ->next pointer with __rcu and uses the appropriate RCU accessors.

Official resources