Vulnerability · CVE-2026-99282

CVE-2026-99282: net/sched: sch_teql: fix use-after-free on lower qdisc drop

Q: Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

Q: What should an analyst verify?

No weakness class is stored. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Published Nov 7, 2026 · catalog updated Nov 7, 2026 · Linux Linux

Last checked Nov 8, 2026. A connected source was read within the last 7 days.

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-99282. A missing EPSS score is not a low risk. Compare Linux Linux with the linked advisory before you change production.

Gaps on this record

No version range is stored. A customer cannot check an installed version against this record.
No vendor fix or required action is stored. Compare the linked advisory before you change production.
EPSS is missing. A missing score is not a low risk.

Same product and reporting

CVE-2026-99284 · Unknown
CVE-2026-99283 · Unknown
CVE-2026-99281 · Unknown
CVE-2026-99280 · Unknown
CVE-2026-99279 · Unknown

Severity: Unknown—
Known exploitation: Not in CISA/VulnCheck KEV
EPSS: Not in the current FIRST EPSS dataset
Remediation: Not established
Affected products: linux kernel · vendor Linux Linux

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes the skb but returns an error code (rc dev and calls __skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit() from its ndo_start_xmit() (propagated since cbbef5e18307), and when the lower qdisc drops the packet that value is NET_XMIT_DROP after the skb has been freed, giving a use-after-free in teql_master_xmit(). The Fix: test for consumption with dev_xmit_complete(), which accepts NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps the packet counted in tx_packets/tx_bytes and advances the slave; a consumed result that is neither a success nor NET_XMIT_CN ends the attempt and is charged to tx_dropped, so lower-qdisc drops are no longer reported as good transmits. NET_XMIT_CN is counted like success because it can accompany acceptance of the current packet: pfifo_head_drop drops the old head, enqueues the current skb and returns NET_XMIT_CN. Conditions to recreate the bug: With CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0 and a teql0 root on lkrvlan0; bring teql0 up with an address and send one UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower qdisc while holding a freed skb.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

linux kernelversion unspecified
vendor Linux Linuxversion unspecified

How to fix CVE-2026-99282

No stored fix
No vendor fix text is stored. Use the linked advisory before you change production.
Version check
No version range is stored, so an installed version cannot be checked on this page.
Advisory
Open the cve_org record and follow its fix.
Official advisories
- CVE.org · cve.org
- Linux Kernel CVE · git.kernel.org

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Exploitation likelihood is not on this record for CVE-2026-99282. A missing EPSS score is not a low risk. Compare Linux Linux with the linked advisory before you change production.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS is absent from the current FIRST dataset. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Nov 7, 2026 · Linux Kernel CVE
Detected
From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes the skb but returns an error code (rc dev and calls __skb_pull() on it. A VLAN slave returns th

Sources

CVE.orgVulnerability recordCVE-2026-99282
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes the skb but returns an e
cve.org
Linux Kernel CVEVendor advisoryCVE-2026-99282
From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: fix use-after-free on lower qdisc drop The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alon
git.kernel.org

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

CVE.orgNov 8, 2026
Linux Kernel CVENov 7, 2026