CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
In the Linux kernel, the following vulnerability has been resolved:
net/sched: schmultiq: Replace direct dequeue call with peek and qdiscdequeuepeeked
multiqdequeue() takes a packet from a band's child with a direct ->dequeue() call after multiqpeek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gsoskb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.
Take the packet through qdiscdequeuepeeked(), as schprio already does and as schred and schsfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72036?
CVE-2026-72036 has a risk score of 60, indicating a moderate severity level.
How do I fix CVE-2026-72036?
Fixing CVE-2026-72036 involves updating to the latest version of the Linux kernel where the vulnerability has been resolved.
What systems are affected by CVE-2026-72036?
CVE-2026-72036 affects systems running vulnerable versions of the Linux kernel that implement the sch_multiq module.
What type of vulnerability is CVE-2026-72036?
CVE-2026-72036 is a vulnerability related to improper handling in the network scheduler of the Linux kernel.
Is CVE-2026-72036 actively exploited?
As of now, there are no reported active exploits for CVE-2026-72036, but it is important to apply the fix to mitigate any potential risks.