--- cve: "CVE-2026-72035" severity: "HIGH" cvss: 8.2 epss: "54%" vendor: "Linux" kev: false exploited: false published: "2026-08-15 06:21:12" tags: [cve, security, high] source: tsecurity.de CVE-Dossier exported: "2026-09-10T23:13:47+02:00" --- # CVE-2026-72035 > 8.2 HIGH ## Beschreibung In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child ->dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child's qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child's stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget. ## CVSS-Vektor ``` CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H ``` | Metrik | Wert | Bewertung | |---|---|---| | AV Angriffsvektor | Netzwerk | bad | | AC Komplexität | Gering | bad | | PR Privilegien | Keine | bad | | UI Interaktion | Keine | bad | | S Scope | Unverändert | good | | C Vertraulichkeit | Keine | good | | I Integrität | Gering | warn | | A Verfügbarkeit | Hoch | bad | ## Patch verfügbar (OSV) - Kernel ≥ 5.10.266 - Kernel ≥ 5.15.217 - Kernel ≥ 6.1.184 - Kernel ≥ 6.6.145 - Kernel ≥ 6.12.97 - Kernel ≥ 6.18.40 - Kernel ≥ 7.1.5 ## Referenzen - - - - - - - - --- _Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-72035) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_