Use-After-Free Vulnerability in Linux Kernel Networking Components

CVE-2026-99282

What is CVE-2026-99282?

A vulnerability in the Linux kernel's networking stack can lead to a use-after-free condition in the packet queuing mechanism. Specifically, in the sch_teql module, when a slave's ndo_start_xmit() returns an error value, the packet's ownership is not correctly updated. This oversight means that even after a packet has been freed, the system may still attempt to process it, resulting in unstable behavior. This issue can be reproduced under specific conditions involving VLAN configurations and dummy network devices, necessitating robust testing and mitigation strategies to ensure network integrity and performance.

References