Skip to main content

Linux Kernel CVE-2026-72036

| EUVDEUVD-2026-58994 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-6mv6-43g2-7qmw
Information Disclosure Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC raised to H because exploitation requires a specific non-default three-level qdisc hierarchy (multiq+tbf+qfq); PR:L confirmed since CAP_NET_ADMIN or namespace equivalent is required.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 06:24 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call after multiq_peek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gso_skb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_prio already does and as sch_red and sch_sfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.

AnalysisAI

Kernel panic via NULL pointer dereference in the Linux kernel's multiq traffic scheduler (net/sched/sch_multiq) affects all kernels from 2.6.29 through unpatched stable trees. When multiq pairs with a non-work-conserving child qdisc (such as qfq) routed through a peeking intermediary (such as tbf), multiq_dequeue() invokes the child's raw ->dequeue() method directly instead of qdisc_dequeue_peeked(), orphaning the stash, corrupting qlen/backlog accounting, and triggering a NULL dereference in softirq context during ordinary egress. Exploitation requires local access with CAP_NET_ADMIN and a deliberately constructed qdisc hierarchy; no public exploit code exists and EPSS probability is 0.21% (12th percentile), consistent with the niche configuration requirement.

Technical ContextAI

The vulnerability lives in net/sched/sch_multiq.c, present since commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 (Linux 2.6.29) when sch_multiq was introduced. The Linux traffic control (tc) subsystem allows composing qdiscs in hierarchies; multiq distributes packets across multiple bands each backed by a child qdisc. Non-work-conserving qdiscs-such as qfq (Quick Fair Queueing) and tbf (Token Bucket Filter)-stash peeked packets in the child's gso_skb field rather than immediately dequeuing them, a contract codified by the qdisc_dequeue_peeked() helper. sch_prio, sch_red, and sch_sfb all use this helper correctly. sch_multiq does not: multiq_dequeue() calls the child's ->dequeue() pointer directly after multiq_peek() has already stashed an skb via gso_skb. For a non-work-conserving child this dequeues a different packet, orphaning the stash and desyncing qlen/backlog. When qfq is nested under a peeking tbf parent and multiq re-enters qfq on an emptied list, the kernel dereferences NULL in softirq context, producing an immediate kernel panic. The root cause is an API contract violation: sch_multiq's dequeue path was never updated to use the peek/dequeue helper that the rest of the scheduler family adopted.

RemediationAI

Upgrade to a patched kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc2, applying the upstream fix commits available at https://git.kernel.org/stable/c/1b9cc255e8089606b92b2adf504e334573682821 and the seven associated per-branch commits. Distributions should apply vendor-supplied kernel updates through their normal security channels. Where an immediate kernel update is not feasible, the most targeted compensating control is to audit and eliminate vulnerable qdisc hierarchies: run 'tc qdisc show' on all interfaces and remove any multiq configurations that use non-work-conserving children (qfq, sfq variants) routed through intermediary peeking parents (tbf, red); restructuring to work-conserving children removes the triggering condition at the cost of traffic-shaping flexibility. Additionally, restricting CAP_NET_ADMIN to trusted processes via seccomp profiles, SELinux/AppArmor policy, or namespace isolation prevents unprivileged container workloads from constructing the vulnerable hierarchy in the first place.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72036 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy