CVE-2026-72035 net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
A null pointer dereference in the Linux kernel's taprio scheduler can cause a kernel panic during egress traffic, leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72035?
CVE-2026-72035 is a high-severity vulnerability in Linux, published on 15 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked
When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child ->dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child's qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.
Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child's stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.
Weakness: CWE-476
Which versions are affected by CVE-2026-72035?
How do I fix CVE-2026-72035?
Apply the vendor's patch.
Is CVE-2026-72035 being exploited?
There is no known exploitation of CVE-2026-72035 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72035, DEBIAN-CVE-2026-72035, GHSA-cjrv-4qm5-hp28, UBUNTU-CVE-2026-72035.