CVE-2026-72036

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the multiq dequeue() function where a packet is retrieved from a band's child using a direct ->dequeue() call following a multiq peek() operation. In cases where the child is non-work-conserving, the peek operation stashes the socket buffer (skb) in the child's gso skb. Consequently, the direct dequeue returns a different skb, which orphans the stash and desynchronizes the child's queue length and backlog. When a qfq child is accessed via a peeking parent, such as tbf, this process can lead to a NULL pointer dereference on an emptied list, resulting in a kernel panic during softirq on ordinary egress.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.