Security readout for executives and security teams
Plain-English summary
A race condition in Linux TEQL traffic scheduling can free network packet memory twice, potentially crashing the system or corrupting kernel memory. Exploitation requires local access and the affected TEQL configuration. Because successful memory corruption could affect confidentiality, integrity, and availability, exposed systems should receive timely kernel updates.
Executive priority
Prioritize affected multi-user, appliance, and network-oriented Linux systems where TEQL is actually configured. Patch promptly through normal emergency or high-severity maintenance processes. Systems without TEQL exposure can follow routine kernel remediation after validation. No source supports treating this as an actively exploited emergency.
Technical view
When a TEQL device uses a lockless root qdisc, resetting that qdisc without the required sequence lock can race with packet processing. The resulting double-free occurs in socket-buffer handling during TEQL teardown or qdisc changes. The published fix protects qdisc_reset with seq_lock. CVSS 3.1 is 7.8: local, low-complexity, low-privilege, no user interaction.
Likely exposure
Exposure is limited to Linux systems running an affected kernel where TEQL is configured with a lockless root qdisc. General Linux installation alone does not establish exposure. The bundle lists multiple affected versions through 7.0, but distributions may backport fixes without changing upstream version numbers; verify using vendor advisories and package changelogs.
Exploitation context
The bundle marks this CVE as absent from KEV and provides no evidence of active exploitation. A KASAN-detected double-free and proof-of-concept process names demonstrate reproducibility in testing, not observed malicious use. Local access is required according to the supplied CVSS vector.
Researcher notes
The supplied evidence supports a concurrency-driven double-free in net/sched/sch_teql.c involving qdisc_reset and datapath activity. Stable-tree commits are available, but the bundle does not provide a complete introduced-versus-fixed version matrix or demonstrate reliable code execution. Assess distribution backports and configuration prerequisites before assigning asset-level risk.
Mitigation direction
- Install a vendor-supported kernel update containing the applicable stable fix.
- Until patched, avoid affected TEQL configurations with lockless root qdiscs where operationally feasible.
- Restrict local access and privileges capable of changing network scheduling configuration.
- Check relevant Siemens advisories if affected Linux components are embedded in Siemens products.
Validation and detection
- Inventory kernel package versions and confirm vendor backport status for CVE-2026-23449.
- Identify systems using TEQL and determine whether their root qdisc is lockless.
- Confirm the installed kernel contains the applicable upstream stable commit or vendor-equivalent backport.
- Review kernel logs for qdisc, TEQL, double-free, skbuff, KASAN, or unexplained crash indicators.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-23449 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4e8ebc4c18ea8213d28e6cb867d18fcc67daca21CVE reference, Linux
- https://git.kernel.org/stable/c/21c89a0a8de7eadad8d385645a95b3233f23130eCVE reference, Linux
- https://git.kernel.org/stable/c/afbc79a7770b230a9f24bd39271209d6b3682c5fCVE reference, Linux
- https://git.kernel.org/stable/c/e9c66d3e7d8557b3308e55c613aa07254fe97611CVE reference, Linux
- https://git.kernel.org/stable/c/4a233447b941db451ea5f5a0942cffd0f7f7eaaeCVE reference, Linux
- https://git.kernel.org/stable/c/66360460cab63c248ca5b1070a01c0c29133b960CVE reference, Linux
- https://cert-portal.siemens.com/productcert/html/ssa-082556.htmlCVE reference, siemens-SADP
- https://cert-portal.siemens.com/productcert/html/ssa-019113.htmlCVE reference, siemens-SADP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.