CVE-2026-72035
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
- 8.2HighCVSS base score
- 0.59%Exploitation in 30 daysEPSS · top 51% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child ->dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child's qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child's stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
| NVDNVD · Received | 3.1 | High8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H |
- EPSS (exploitation in 30 days)
- 0.59% · top 51% of all CVEs (11 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.2.
Affected products
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < 51f8af240aed903e988755af33d7491030b50ae9
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < 17ab5f76f3899f67e5569722f334591f4b88b17b
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < f60d5c12e0551012cee5c272b0bcbcc78f7bb506
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < 6ee5a7665a9080bcb05d703bf981a579436fd05e
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < 18d580cb00c55805633bae45e90cf22ed6b8e424
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < 2dcebbd1ad2e180fe7b98bf346ced69a872e11e6
- affected 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 – < e056e1dfcddca877dd46d704e8ec9860cfc9ec44
- affected 4.20
- unaffected < 4.20
- unaffected 5.10.266 – ≤ 5.10.*
- unaffected 5.15.217 – ≤ 5.15.*
- unaffected 6.1.184 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.97 – ≤ 6.12.*
- unaffected 6.18.40 – ≤ 6.18.*
- unaffected 7.1.5 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/51f8af240aed903e988755af33d7491030b50ae9 (opens in a new tab)
- https://git.kernel.org/stable/c/17ab5f76f3899f67e5569722f334591f4b88b17b (opens in a new tab)
- https://git.kernel.org/stable/c/f60d5c12e0551012cee5c272b0bcbcc78f7bb506 (opens in a new tab)
- https://git.kernel.org/stable/c/6ee5a7665a9080bcb05d703bf981a579436fd05e (opens in a new tab)
- https://git.kernel.org/stable/c/18d580cb00c55805633bae45e90cf22ed6b8e424 (opens in a new tab)
- https://git.kernel.org/stable/c/e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09 (opens in a new tab)
- https://git.kernel.org/stable/c/2dcebbd1ad2e180fe7b98bf346ced69a872e11e6 (opens in a new tab)
- https://git.kernel.org/stable/c/e056e1dfcddca877dd46d704e8ec9860cfc9ec44 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-58993 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-72035)Record last updated .