Linux Kernel CVE-2026-72035

The Linux kernel's Traffic Control (tc) subsystem implements quality-of-service via pluggable qdisc (queuing discipline) objects. taprio (Time-Aware Priority Shaper, aligned with IEEE 802.1Qbv) operates as a parent qdisc gating traffic classes by time windows. When taprio peeks a non-work-conserving child qdisc such as qfq (Quick Fair Queueing), the child stashes the retrieved skb in its internal gso_skb field rather than returning it immediately - a standard peek-stash contract. The bug is that taprio_dequeue_from_txq() then calls the child's ->dequeue() function pointer directly, which is unaware of the stash, producing three cascading effects: (1) the stashed skb is orphaned, leaking memory; (2) the child's qlen and backlog counters desync from actual queue state; and (3) on the subsequent dequeue cycle, the child re-enters its internal list logic on an already-emptied structure, dereferencing a NULL pointer from softirq context. The fix substitutes qdisc_dequeue_peeked() - a helper that returns the stashed skb first when present and is a no-op for work-conserving children - consistent with the approach already adopted by sch_red and sch_sfb. The vulnerability traces to commit 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22, which introduced sch_taprio in Linux 4.20.