CVE-2026-72035 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child ->dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child's qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.
Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child's stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's traffic control subsystem, specifically in the sch_taprio qdisc implementation that handles time-aware packet scheduling for real-time networking applications. The issue stems from improper handling of packet dequeuing operations when interacting with child qdiscs that employ peek operations for packet inspection before actual dequeueing. The flaw manifests when taprio processes packets through its software path where it performs a peek operation on non-work-conserving child qdiscs, causing the child qdisc to stash the peeked packet in its gso_skb field for later retrieval.
The technical implementation error occurs because taprio_dequeue_from_txq() function directly invokes the child qdisc's ->dequeue() method without properly accounting for packets that were previously stashed during peek operations. This direct dequeue call bypasses the normal packet handling flow and ignores the stashed skb that was created when the child qdisc peeked at a packet. When this occurs, the original peeked packet becomes orphaned from its proper queue context while simultaneously causing a desynchronization between the child qdisc's internal state variables including qlen and backlog counters.
The operational impact of this vulnerability is severe as it can lead to kernel panics during softirq execution when the system encounters a NULL pointer dereference. This situation particularly affects qfq (Quick Fair Queuing) child qdisc implementations where the re-entrancy into an emptied list causes the kernel to attempt accessing freed memory locations, resulting in system instability and potential denial of service conditions. The vulnerability represents a classic case of improper resource management where packet state information becomes inconsistent between different queueing mechanisms within the kernel's traffic control framework.
The fix implemented addresses this issue by replacing the direct child dequeue call with the qdisc_dequeue_peeked() helper function, which properly handles both stashed packets and normal dequeuing operations. This approach aligns taprio with other established qdisc implementations like sch_red and sch_sfb that already utilize this pattern for consistent packet handling. The qdisc_dequeue_peeked() function returns any previously stashed skb from the child qdisc first, while functioning as a no-op when no such stash exists, ensuring compatibility with both work-conserving and non-work-conserving child qdiscs. This solution effectively resolves the queue length synchronization issue and prevents the NULL pointer dereference scenarios that could lead to kernel panics.
This vulnerability maps to CWE-476 Null Pointer Dereference and CWE-121 Stack-based Buffer Overflow within the Common Weakness Enumeration framework, representing a critical security concern in kernel space memory management. From an ATT&CK perspective, this issue falls under T1547.001 Account Manipulation and T1498.001 Network Denial of Service, as it can lead to system instability and denial of service conditions through kernel panic scenarios. The fix ensures proper adherence to Linux kernel traffic control API specifications and maintains consistency with established patterns for handling peek/dequeue operations in the networking subsystem.