CVE-2026-23074

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will describe the scenario that unearthed this issue for the curious. GangMin Kim <km.kim1503@gmail.com> managed to concot a scenario as follows: ROOT qdisc 1:0 (QFQ) ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s └── class 1:2 (weight=1, lmax=1514) teql GangMin sends a packet which is enqueued to 1:1 (netem). Any...

Affected product and versions

Product

Linux Linux, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION, Red Hat Enterprise Linux 7 Extended Lifecycle Support

Affected versions

>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 73d970ff0eddd874a84c953387c7f4464b705fc6, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < ae810e6a8ac4fe25042e6825d2a401207a2e41fb, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < dad49a67c2d817bfec98e6e45121b351e3a0202c, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 0686bedfed34155520f3f735cbf3210cb9044380, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 4c7e8aa71c9232cba84c289b4b56cba80b280841, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 16ed73c1282d376b956bff23e5139add061767ba, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 50da4b9d07a7a463e2cfb738f3ad4cff6b2c9c3b, >= 2.6.12, >= 2.6.12.1 < 5.10.249, >= 5.11 < 5.15.199, >= 5.16 < 6.1.162, >= 6.2 < 6.6.122, >= 6.7 < 6.12.68, >= 6.13 < 6.18.8, 2.6.12, 6.19

Fixed versions

5.10.249, 5.15.199, 6.1.162, 6.6.122, 6.12.68, 6.18.8

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416, CWE-825