CVE-2026-23074

A flaw in the Linux kernel’s traffic control subsystem permits the teql queuing discipline to be installed as a child of a root qdisc. When a packet is deferred by a parent qdisc, teql fails to update the queue length and the parent deactivates the child prematurely, leaving a dangling pointer that is dereferenced during a later dequeuing operation. This use‑after‑free condition can crash the kernel, potentially leading to a denial of service. The weakness is classified as CWE‑416 and CWE‑825.

All publicly available Linux kernel images are vulnerable until they are updated past the commit that enforces thteql usage as a root qdisc only. The affected releases include kernels 2.6.12 through at least 6.19, as indicated by the CPE list. The flaw exists in the kernel’s net/sched code and therefore applies to every distribution implementing the stock Linux kernel.

The CVSS score of 7.8 indicates high severity, yet the EPSS score is below 1%, showing a low probability of widespread exploitation in the current landscape. The vulnerability requires local or privileged kernel access to configure qdiscs; consequently an attacker with root or elevated capabilities could manipulate network traffic to trigger the use‑after‑free. Because the issue resides in kernel memory, successful exploitation could result in a kernel crash, leading to a denial of service. No public exploit is recorded and the flaw is not listed in the CISA KEV catalog at this time.