Bug 2516411 (CVE-2026-72036)

Summary: CVE-2026-72036 kernel: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: rhel-process-autobot, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's `sch_multiq` component, which handles network packet scheduling. This vulnerability occurs when a non-work-conserving child queue is improperly handled after a packet has been temporarily stored. This can lead to a desynchronization of network packet queues and a null pointer dereference. An attacker could exploit this by sending specially crafted network traffic, causing the kernel to panic and resulting in a Denial of Service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-15 06:11:06 UTC 
In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

multiq_dequeue() takes a packet from a band's child with a direct
->dequeue() call after multiq_peek() peeked it. When the child is
non-work-conserving the peek stashes the skb in the child's gso_skb, so
the direct dequeue returns a different skb and orphans the stash,
desyncing the child's qlen/backlog. With a qfq child reached through a
peeking parent (e.g. tbf) this re-enters the child on an emptied list and
dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
when the child has no stash, so a work-conserving child is unaffected.
Comment 1 Keith Grant 2026-08-17 17:15:41 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026081512-CVE-2026-72036-1317@gregkh/T