CVE-2026-72036 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call after multiq_peek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gso_skb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.
Take the packet through qdisc_dequeue_peeked(), as sch_prio already does and as sch_red and sch_sfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability exists within the Linux kernel's networking subsystem, specifically in the multi-queue traffic control implementation under net/sched/sch_multiq.c. The issue stems from improper handling of packet dequeuing operations when dealing with non-work-conserving queuing disciplines that utilize internal packet stashing mechanisms. The flaw manifests when a parent queuing discipline performs a peek operation followed by a direct dequeue call, creating a critical desynchronization between the queue state and the actual packet flow.
The technical root cause involves the multiq_dequeue() function which operates on a band's child queuing discipline using a two-step process of peeking first and then dequeuing directly. When the child queuing discipline is non-work-conserving, it maintains internal state through gso_skb to stash packets during peek operations. This stashing mechanism becomes problematic because the direct dequeue call bypasses proper state management, resulting in a scenario where the dequeued packet differs from the peeked packet. This desynchronization causes the child's qlen and backlog counters to become inconsistent, creating a fundamental mismatch in queue state tracking that can lead to severe kernel instability.
The operational impact of this vulnerability is particularly dangerous as it can cause kernel panics during softirq execution contexts when processing ordinary egress traffic. The specific scenario occurs when a queuing discipline like qfq is accessed through a peeking parent such as tbf, which triggers a re-entrancy condition where the child queuing discipline attempts to process packets from an emptied queue list. This NULL pointer dereference results in immediate system crashes and potential denial of service conditions that affect network packet processing capabilities across the entire kernel.
The recommended mitigation strategy involves replacing the direct dequeue call pattern with the qdisc_dequeue_peeked() helper function, which properly handles the stashing state management between peek and dequeue operations. This approach mirrors existing implementations within other queuing disciplines such as sch_prio, sch_red, and sch_sfb that have already been updated to follow this correct pattern. The qdisc_dequeue_peeked() helper function is designed as a no-op for work-conserving child disciplines, ensuring backward compatibility while providing the necessary state management for non-work-conserving disciplines.
This vulnerability aligns with CWE-121 and CWE-125 categories related to buffer overflow conditions and out-of-bounds reads, respectively, as the improper handling of packet stashing creates memory access violations. From an ATT&CK framework perspective, this represents a privilege escalation vector through kernel exploitation, potentially allowing malicious actors to cause system instability or achieve unauthorized access to network processing capabilities. The vulnerability affects all Linux kernel versions implementing the multi-queue traffic control subsystem and requires immediate patching to prevent potential exploitation scenarios that could compromise network infrastructure reliability and availability.
The fix demonstrates proper adherence to kernel networking best practices by ensuring consistent state management across queuing discipline operations and preventing the introduction of race conditions or memory corruption issues. This represents a critical security update that addresses fundamental design flaws in the packet processing pipeline, particularly concerning the interaction between parent and child queuing disciplines in complex traffic control configurations.