7.8

CVE-2026-72036

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

multiq_dequeue() takes a packet from a band's child with a direct
->dequeue() call after multiq_peek() peeked it. When the child is
non-work-conserving the peek stashes the skb in the child's gso_skb, so
the direct dequeue returns a different skb and orphans the stash,
desyncing the child's qlen/backlog. With a qfq child reached through a
peeking parent (e.g. tbf) this re-enters the child on an emptied list and
dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
when the child has no stash, so a work-conserving child is unaffected.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a
Status affected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < eb1a9637f0bd84b5db8803af65dfb1f44785406f
Status affected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < 7a5a1582710981ef6637de9f074a60a5b1d63222
Status affected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < 86a61e46a1919e8abf4d227c204773dabb24068a
Status affected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < 1b9cc255e8089606b92b2adf504e334573682821
Status affected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < 5889064919a1e5c0a9469c54895000414fc46944
Status affected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < fffeb2ab5eeb823d4c2330571a098f63237c9049
Status affected
Version 77be155cba4e163e8bba9fd27222a8b6189ec4f7
Version < 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 2.6.29
Status affected
Version 0
Version < 2.6.29
Status unaffected
Version <= 5.10.*
Version 5.10.261
Status unaffected
Version <= 5.15.*
Version 5.15.212
Status unaffected
Version <= 6.1.*
Version 6.1.178
Status unaffected
Version <= 6.6.*
Version 6.6.145
Status unaffected
Version <= 6.12.*
Version 6.12.97
Status unaffected
Version <= 6.18.*
Version 6.18.40
Status unaffected
Version <= 7.1.*
Version 7.1.5
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.061
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a
https://git.kernel.org/stable/c/eb1a9637f0bd84b5db8803af65dfb1f44785406f
https://git.kernel.org/stable/c/7a5a1582710981ef6637de9f074a60a5b1d63222
https://git.kernel.org/stable/c/86a61e46a1919e8abf4d227c204773dabb24068a
https://git.kernel.org/stable/c/1b9cc255e8089606b92b2adf504e334573682821
https://git.kernel.org/stable/c/5889064919a1e5c0a9469c54895000414fc46944
https://git.kernel.org/stable/c/fffeb2ab5eeb823d4c2330571a098f63237c9049
https://git.kernel.org/stable/c/54f6b0c843e228d499eb4b6bbb89df68cad9ad5d