CVE-2026-72036net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call after multiq_peek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gso_skb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_prio already does and as sch_red and sch_sfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 77be155cba4e163e8bba9fd27222a8b6189ec4f7 builds before 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a; from 77be155cba4e163e8bba9fd27222a8b6189ec4f7 before eb1a9637f0bd84b5db8803af65dfb1f44785406f; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 builds before 7a5a1582710981ef6637de9f074a60a5b1d63222; from 77be155cba4e163e8bba9fd27222a8b6189ec4f7 before 86a61e46a1919e8abf4d227c204773dabb24068a; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 builds before 1b9cc255e8089606b92b2adf504e334573682821; from 77be155cba4e163e8bba9fd27222a8b6189ec4f7 before 5889064919a1e5c0a9469c54895000414fc46944; from 77be155cba4e163e8bba9fd27222a8b6189ec4f7 before fffeb2ab5eeb823d4c2330571a098f63237c9049; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 builds before 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d | CNA record |
References
- https://git.kernel.org/stable/c/3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a
- https://git.kernel.org/stable/c/eb1a9637f0bd84b5db8803af65dfb1f44785406f
- https://git.kernel.org/stable/c/7a5a1582710981ef6637de9f074a60a5b1d63222
- https://git.kernel.org/stable/c/86a61e46a1919e8abf4d227c204773dabb24068a
- https://git.kernel.org/stable/c/1b9cc255e8089606b92b2adf504e334573682821
- https://git.kernel.org/stable/c/5889064919a1e5c0a9469c54895000414fc46944
- https://git.kernel.org/stable/c/fffeb2ab5eeb823d4c2330571a098f63237c9049
- https://git.kernel.org/stable/c/54f6b0c843e228d499eb4b6bbb89df68cad9ad5d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.