The Linux kernel vulnerability CVE-2026-90071 involves the net/sched sch_teql module where teql_master_xmit() sets skb->dev to a slave device before transmission but fails to restore it on transmit failure. This causes the skb to retain a stale device pointer, which can be freed if the slave device is deleted, leading to a use-after-free (UAF) condition when the skb is later processed by functions such as arp_error_report() or neigh_direct_output(). The flaw can cause kernel memory corruption and crashes. The issue was fixed by restoring skb->dev to the master device at the end of each slave's iteration.

Successful exploitation of this vulnerability can lead to a use-after-free condition in the kernel, causing memory corruption, system instability, or crashes. The CVSS v3.1 score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability. There are no reports of active exploitation in the wild.

A fix for this vulnerability has been implemented in the Linux kernel by restoring skb->dev to the master device after each slave's transmit attempt. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; check the official Linux kernel advisories or vendor patches for the exact fixed versions and update accordingly.