Use After Free Affecting openshift/ose-rhel-coreos-8 package, versions *
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-RHEL7-OPENSHIFTOSERHELCOREOS8-22369523
- published8 Nov 2026
- disclosed7 Nov 2026
Introduced: 7 Nov 2026
NewCVE-2026-99282 (opens in a new tab)How to fix?
There is no fixed version for RHEL:7 openshift/ose-rhel-coreos-8.
NVD Description
Note: Versions mentioned in the description apply only to the upstream openshift/ose-rhel-coreos-8 package and not the openshift/ose-rhel-coreos-8 package as distributed by RHEL.
See How to fix? for RHEL:7 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_teql: fix use-after-free on lower qdisc drop
The issue: teql_master_xmit() tests the slave's ndo_start_xmit() return value against NETDEV_TX_OK alone. A slave that consumes the skb but returns an error code (rc < NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated as if the skb were still owned, so the loop restores skb->dev and calls __skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit() from its ndo_start_xmit() (propagated since cbbef5e18307), and when the lower qdisc drops the packet that value is NET_XMIT_DROP after the skb has been freed, giving a use-after-free in teql_master_xmit().
The Fix: test for consumption with dev_xmit_complete(), which accepts NETDEV_TX_OK and every rc < NET_XMIT_MASK, matching other callers that need to distinguish consumed results from busy. Only NETDEV_TX_OK keeps the packet counted in tx_packets/tx_bytes and advances the slave; a consumed result that is neither a success nor NET_XMIT_CN ends the attempt and is charged to tx_dropped, so lower-qdisc drops are no longer reported as good transmits. NET_XMIT_CN is counted like success because it can accompany acceptance of the current packet: pfifo_head_drop drops the old head, enqueues the current skb and returns NET_XMIT_CN.
Conditions to recreate the bug: With CONFIG_NET_SCH_TEQL, CONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and lkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0 and a teql0 root on lkrvlan0; bring teql0 up with an address and send one UDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower qdisc while holding a freed skb.
References
- https://access.redhat.com/security/cve/CVE-2026-99282
- https://git.kernel.org/stable/c/2702ae318630787c640ec0d0403ffd9d95c43e9e
- https://git.kernel.org/stable/c/782d6bb8f9b8e9d8591181662222bf74cd3ecf79
- https://git.kernel.org/stable/c/fc55d92ae6a4b2e7d062cad6d4c67f6b061d9cde
- https://git.kernel.org/stable/c/8d5f768780e26cb82c389219ae7fdb1cd7255421