CVE-2026-72036

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-72036

Key Details

CVE	CVE-2026-72036
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

multiq_dequeue() takes a packet from a band's child with a direct

->dequeue() call after multiq_peek() peeked it. When the child is

non-work-conserving the peek stashes the skb in the child's gso_skb, so

the direct dequeue returns a different skb and orphans the stash,

desyncing the child's qlen/backlog. With a qfq child reached through a

peeking parent (e.g. tbf) this re-enters the child on an emptied list and

dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_prio already does

and as sch_red and sch_sfb were just fixed to do. The helper is a no-op

when the child has no stash, so a work-conserving child is unaffected. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-72036
CVE	https://www.cve.org/CVERecord?id=CVE-2026-72036

Source

Reference

NVD

CVE