Exploit and Full Details Released for 20-Year-Old Linux Kernel teql Flaw CVE-2026-23074
TL;DR
A full write-up and exploit are now public for CVE-2026-23074, a Linux kernel privilege escalation flaw in the teql traffic-control scheduler. The use-after-free dates back to Linux 2.6.12, the start of the kernel’s Git history in 2005. Researchers used it to gain root and escape a container on Google’s Container-Optimized OS in the kernelCTF program.
Why It Matters
The bug survived in the kernel’s networking code for about two decades. Fixed stable kernels shipped earlier this year, but many systems lag behind on kernel updates. Now that working exploit code is public, unpatched hosts face a known, tested path to root.
The kernel CVE team rates the flaw CVSS 7.8. Red Hat scores it 7.0 and calls it “Moderate,” citing higher attack complexity.
Exploit and details are public
The full analysis and exploit sit in Google’s kernelCTF repository for CVE-2026-23074. The authors say the bug “can potentially lead to privilege escalation.” Their exploit ends with root credentials and a namespace escape.
How the Attack Works
The teql qdisc is a traffic-control queueing discipline that combines several links into one. It was designed to run only as a root qdisc. However, the kernel never enforced that rule. That gap opened a Linux kernel privilege escalation path that went unnoticed for years.
When teql runs as a child of another scheduler, such as QFQ, its packet count goes stale. According to the write-up, teql “does not increment sch->q.qlen on enqueue.” Its peek function also “always returns NULL,” so the parent never dequeues from it.
As a result, the parent scheduler thinks the teql class is idle. If an attacker then changes the class settings, the kernel frees an internal structure that is still linked in a list. Later, scheduled packets follow that dangling pointer, triggering a use-after-free.
The kernelCTF exploit turns this into an arbitrary kernel write and then hijacks code execution. It reuses techniques from an earlier exploit for CVE-2025-38477.
Who is at risk
The attack needs CAP_NET_ADMIN, but an unprivileged user can gain it inside a new user namespace. Kernels must also include CONFIG_NET_SCH_TEQL. Credit for the discovery goes to researcher GangMin Kim, according to the kernel fix.
Exploitation status
A public exploit exists. However, no source reports attacks in the wild. CISA’s assessment in the CVE record lists exploitation as “none,” and the flaw is not in the KEV catalog.
Affected Versions
All kernels from 2.6.12 up to the fix are affected. Fixed stable releases include:
- 5.10.249 and 5.15.199
- 6.1.162 and 6.6.122
- 6.12.68 and 6.18.8
- Mainline 6.19
Patch and Mitigation Steps
- Install a fixed kernel from your distribution.
- Disable unprivileged user namespaces where you do not need them.
- Blacklist the sch_teql module if your systems do not use the teql qdisc.
The fix itself is simple: the kernel now refuses to attach teql anywhere but the root. With a public exploit in circulation, admins should close this Linux kernel privilege escalation path on shared and container hosts first.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
