CVE-2026-72036

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 19, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call after multiq_peek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gso_skb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_prio already does and as sch_red and sch_sfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705aAffected 77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before eb1a9637f0bd84b5db8803af65dfb1f44785406fAffected 77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 7a5a1582710981ef6637de9f074a60a5b1d63222Affected 77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 86a61e46a1919e8abf4d227c204773dabb24068aAffected 77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 1b9cc255e8089606b92b2adf504e334573682821Affected 77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 5889064919a1e5c0a9469c54895000414fc46944Affected 77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before fffeb2ab5eeb823d4c2330571a098f63237c9049Affected 77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 54f6b0c843e228d499eb4b6bbb89df68cad9ad5dAffected
LinuxLinux	2.6.29Affected before 2.6.29Not affected 5.10.261 through 5.10.Not affected 5.15.212 through 5.15.Not affected 6.1.178 through 6.1.Not affected 6.6.145 through 6.6.Not affected 6.12.97 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705aAffected
77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before eb1a9637f0bd84b5db8803af65dfb1f44785406fAffected
77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 7a5a1582710981ef6637de9f074a60a5b1d63222Affected
77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 86a61e46a1919e8abf4d227c204773dabb24068aAffected
77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 1b9cc255e8089606b92b2adf504e334573682821Affected
77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 5889064919a1e5c0a9469c54895000414fc46944Affected
77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before fffeb2ab5eeb823d4c2330571a098f63237c9049Affected
77be155cba4e163e8bba9fd27222a8b6189ec4f7 to before 54f6b0c843e228d499eb4b6bbb89df68cad9ad5dAffected

LinuxLinux

2.6.29Affected
before 2.6.29Not affected
5.10.261 through 5.10.*Not affected
5.15.212 through 5.15.*Not affected
6.1.178 through 6.1.*Not affected
6.6.145 through 6.6.*Not affected
6.12.97 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.