CVE-2026-72035

net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

State: Published
Severity: 8.2 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child ->dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child's qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child's stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.

Scores

CVSS	Score	Vector	Source
3.1	8.2 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 51f8af240aed903e988755af33d7491030b50ae9Affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 17ab5f76f3899f67e5569722f334591f4b88b17bAffected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before f60d5c12e0551012cee5c272b0bcbcc78f7bb506Affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 6ee5a7665a9080bcb05d703bf981a579436fd05eAffected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 18d580cb00c55805633bae45e90cf22ed6b8e424Affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09Affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 2dcebbd1ad2e180fe7b98bf346ced69a872e11e6Affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before e056e1dfcddca877dd46d704e8ec9860cfc9ec44Affected
LinuxLinux	4.20Affected before 4.20Not affected 5.10.266 through 5.10.Not affected 5.15.217 through 5.15.Not affected 6.1.184 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 51f8af240aed903e988755af33d7491030b50ae9Affected
5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 17ab5f76f3899f67e5569722f334591f4b88b17bAffected
5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before f60d5c12e0551012cee5c272b0bcbcc78f7bb506Affected
5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 6ee5a7665a9080bcb05d703bf981a579436fd05eAffected
5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 18d580cb00c55805633bae45e90cf22ed6b8e424Affected
5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09Affected
5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before 2dcebbd1ad2e180fe7b98bf346ced69a872e11e6Affected
5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to before e056e1dfcddca877dd46d704e8ec9860cfc9ec44Affected

LinuxLinux

4.20Affected
before 4.20Not affected
5.10.266 through 5.10.*Not affected
5.15.217 through 5.15.*Not affected
6.1.184 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.