Linux Kernel CVE-2026-72390

Exploitation requires local system access and the CAP_NET_ADMIN Linux capability - this capability is held by root by default and may be granted to container runtimes, network management daemons, or explicitly delegated via ambient capabilities. The sch_teql kernel module must be loaded (either automatically because a TEQL qdisc is configured, or manually); systems that have never used TEQL and have the module absent from their loaded module set are not vulnerable to the race trigger. Multi-core or multi-CPU environments are required for the concurrent execution race to manifest reliably; single-core environments significantly reduce exploitability in practice. No network-facing exposure exists - the entire attack is local. The limiting factors for defenders are: no unauthenticated or network-remote path exists, CAP_NET_ADMIN is not granted to normal unprivileged users by default, and the sch_teql module is not loaded in most production deployments unless TEQL load balancing is specifically configured.

The CVSS 3.1 score of 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the severity once the local prerequisite is satisfied: a kernel-level UAF yielding complete C/I/A impact with no user interaction. The AC:L rating is notable - while race conditions are sometimes rated AC:H, the TEQL qdisc manipulation provides a straightforward trigger path, and the ZDI team's demonstrated POC corroborates the low complexity. The EPSS score of 0.21% (12th percentile) is low and consistent with no confirmed active exploitation, meaning even a mid-sized municipal IT team in bytom should treat this as a medium-urgency patch task rather than a drop-everything emergency. No CISA KEV listing is present in the available data. The primary risk-reduction factor is that exploitation requires local access plus CAP_NET_ADMIN, limiting the exposed population to privileged local users or processes with explicit network administration capabilities - container escapes or unprivileged user exploitation would first require a privilege-escalation step to obtain CAP_NET_ADMIN. The broad kernel deployment footprint elevates aggregate exposure even if per-instance exploitation likelihood is low.

A local user holding CAP_NET_ADMIN creates a TEQL master qdisc with multiple attached slave interfaces, then launches concurrent threads - one repeatedly destroying and reinitializing the slave list while another triggers transmission through teql_master_xmit() - to win the race window between list deallocation and pointer dereference. When the stale pointer in teql_master_xmit() is dereferenced after the slab has been freed and potentially reallocated to attacker-controlled data, the attacker achieves an arbitrary kernel read/write primitive. Trend Micro's ZDI team has demonstrated a working trigger producing the confirmed KASAN trace, though public release of that POC has not been confirmed from available data.