CVE-2026-72390 patches a critical RCU-BH (Read-Copy-Update with Bottom-Half disabled) critical section imbalance in sch_teql, the kernel's True Link Equalizer qdisc. The bug lives in teql_master_xmit(): early-return paths — triggered by packet drops or error conditions — exit without releasing the RCU-BH read-side critical section, leaving BH permanently disabled on that CPU core. This is a latent denial-of-service vector that would only manifest under specific traffic patterns hitting those error paths.
The fix correctly introduces two-layer synchronization: spinlock (slaves_lock) serializes list mutations, while RCU annotations protect readers. This is textbook correct RCU usage. But the patch notes explicitly call out fixing early-return paths to release RCU-BH before exiting — a detail that reveals something uncomfortable: the original code had unbalanced critical sections that no human reviewer caught.
The vulnerability was found by ZDI's coordinated fuzzing program, not incidental discovery. This matters. sch_teql predates git history and sits in a maintenance gray zone — too embedded to remove, too obscure for regular review. The same structural flaw (RCU-BH critical section leaks on error paths) has appeared in sch_sfb, sch_fq_codel, and now sch_teql across separate CVE cycles over a decade. Each fix propagated to its target but never to its cousins. The kernel community documented qdisc RCU locking best practices circa 2015, yet the pattern mutated back into production code.
For defenders: there's no practical way to detect this exploit in flight — BH imbalance doesn't leave obvious log traces. Prioritize patching. Beyond sch_teql, audit any legacy qdisc that combines (1) BH-protected paths, (2) frequent early returns, and (3) code predating 2015 RCU tooling. The ZDI disclosure tells us fuzzing reaches code no human reviewer patrols; assume structurally identical imbalances exist in other untested qdiscs until proven otherwise.
The CVSS 7.8 score understates the risk. With BH disabled, softirq scheduling corrupts subtly — a controlled attacker could weaponize error-path triggering for timing side-channels enabling packet injection or traffic fingerprinting. This isn't just a crash bug; it's a potential traffic manipulation vector in a hot-path subsystem.