CVE-2026-72036

Received Received - Intake

Linux Kernel Net Sched MultiQ Dequeue Use-After-Free

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call after multiq_peek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gso_skb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_prio already does and as sch_red and sch_sfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72036

EUVD

EUVD-2026-58994

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where multiq_dequeue() incorrectly uses a direct dequeue call after multiq_peek() instead of qdisc_dequeue_peeked(). This causes a desync in the child queue's backlog and length, leading to a NULL dereference and kernel panic during packet processing.

Detection Guidance

This vulnerability requires kernel-level inspection to detect. Check kernel logs for softirq panics or NULL dereferences during network egress. Monitor for crashes in traffic control (qdisc) subsystems, particularly with qfq or tbf classes. Use 'dmesg | grep -i panic' or 'journalctl -k | grep -i oops' to identify kernel crashes.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) during network traffic processing, potentially leading to denial-of-service conditions. Systems using affected kernel versions with multiq or qfq qdisc configurations are at risk.

Compliance Impact

This vulnerability is a kernel panic triggered by network packet handling in the Linux kernel. It does not directly relate to data privacy, storage, or access controls that GDPR or HIPAA primarily address. Compliance impact would be indirect if system crashes lead to service disruptions affecting regulated data processing.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-72036. Monitor kernel logs for NULL pointer dereference errors in network traffic handling.

Hi! I’m here to help you understand CVE-2026-72036. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70