{"answers":{"affected":"It affects 1 product.","exploited":"There is no known exploitation of CVE-2026-23074 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-23074 is a high-severity use after free vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-23074 and fix it if it is affected.\n\nWhat it is: CVE-2026-23074 is a high-severity use after free vulnerability in Linux kernel, published on 4 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-23074 in the wild and no public exploit code.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-23074/ (Markdown: https://insights.sbomify.com/CVE-2026-23074/index.md)","id":"CVE-2026-23074","markdown":"https://insights.sbomify.com/CVE-2026-23074/index.md","name":"CVE-2026-23074","record":{"aliases":["AZL-77238","BELL-CVE-2026-23074","DEBIAN-CVE-2026-23074","GHSA-7cwq-2xv8-7cqw","RHSA-2026:3810","ROOT-OS-DEBIAN-11-CVE-2026-23074","ROOT-OS-DEBIAN-12-CVE-2026-23074","ROOT-OS-DEBIAN-13-CVE-2026-23074","ROOT-OS-UBUNTU-2204-CVE-2026-23074","ROOT-OS-UBUNTU-2404-CVE-2026-23074"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the Linux kernel's teql qdisc allows local attackers to execute arbitrary code or escalate privileges when teql is used as a child qdisc.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-825","name":"Expired Pointer Dereference"},{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: Enforce that teql can only be used as root qdisc\n\nDesign intent of teql is that it is only supposed to be used as root qdisc.\nWe need to check for that constraint.\n\nAlthough not important, I will describe the scenario that unearthed this\nissue for the curious.\n\nGangMin Kim \u003ckm.kim1503@gmail.com\u003e managed to concot a scenario as follows:\n\nROOT qdisc 1:0 (QFQ)\n  ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s\n  └── class 1:2 (weight=1, lmax=1514) teql\n\nGangMin sends a packet which is enqueued to 1:1 (netem).\nAny invocation of dequeue by QFQ from this class will not return a packet\nuntil after 6.4s. In the meantime, a second packet is sent and it lands on\n1:2. teql's enqueue will return success and this will activate class 1:2.\nMain issue is that teql only updates the parent visible qlen (sch-\u003eq.qlen)\nat dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's\npeek always returns NULL), dequeue will never be called and thus the qlen\nwill remain as 0. With that in mind, when GangMin updates 1:2's lmax value,\nthe qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's\nqlen was not incremented, qfq fails to deactivate the class, but still\nfrees its pointers from the aggregate. So when the first packet is\nrescheduled after 6.4 seconds (netem's delay), a dangling pointer is\naccessed causing GangMin's causing a UAF.","ecosystems":["Red Hat:rhel_els:6"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"net/sched: Enforce that teql can only be used as root qdisc","id":"CVE-2026-23074","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"use_after_free","year":"2026"},"n_packages":19,"n_references":7,"next":{"headline":"can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak","id":"CVE-2026-23075"},"packages":[{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel","purl":"pkg:rpm/redhat/kernel","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-abi-whitelists","purl":"pkg:rpm/redhat/kernel-abi-whitelists","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug","purl":"pkg:rpm/redhat/kernel-debug","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-debug-debuginfo","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel","purl":"pkg:rpm/redhat/kernel-debug-devel","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo","purl":"pkg:rpm/redhat/kernel-debuginfo","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-i686","purl":"pkg:rpm/redhat/kernel-debuginfo-common-i686","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-s390x","purl":"pkg:rpm/redhat/kernel-debuginfo-common-s390x","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-x86_64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-x86_64","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-devel","purl":"pkg:rpm/redhat/kernel-devel","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/redhat/kernel-doc","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-firmware","purl":"pkg:rpm/redhat/kernel-firmware","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-kdump","purl":"pkg:rpm/redhat/kernel-kdump","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-kdump-debuginfo","purl":"pkg:rpm/redhat/kernel-kdump-debuginfo","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-kdump-devel","purl":"pkg:rpm/redhat/kernel-kdump-devel","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"perf","purl":"pkg:rpm/redhat/perf","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"perf-debuginfo","purl":"pkg:rpm/redhat/perf-debuginfo","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"python-perf","purl":"pkg:rpm/redhat/python-perf","source":"RHSA-2026:3810"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.59.1.el6"],"introduced":["0"],"last_affected":[],"package":"python-perf-debuginfo","purl":"pkg:rpm/redhat/python-perf-debuginfo","source":"RHSA-2026:3810"}],"prev":{"headline":"wifi: rsi: Fix memory corruption due to not set vif driver data size","id":"CVE-2026-23073"},"products":["Linux"],"published":"2026-02-04","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's teql qdisc allows local attackers to execute arbitrary code or escalate privileges when teql is used as a child qdisc.","url":"https://insights.sbomify.com/CVE-2026-23074/"}