CVE-2026-72035 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and users of Linux-based systems, especially those responsible for managing and securing Linux kernel deployments, should review and apply the patch. They should also verify the fix is applied and test network scheduling functionality to ensure the vulnerability is properly addressed.

Technical summary

The Linux kernel vulnerability CVE-2026-72035 was in the sch_taprio component of the net/sched module. The vulnerability was caused by a direct dequeue call instead of using peek and qdisc_dequeue_peeked, leading to issues with non-work-conserving child qdiscs. The vulnerability has been resolved by replacing the direct dequeue call with peek and qdisc_dequeue_peeked. This change addresses issues with non-work-conserving child qdiscs, potentially preventing kernel panics. The fix involves updating the sch_taprio component to use the qdisc_dequeue_peeked helper, which returns the child's stashed skb first and is a no-op when there is none. This ensures that the gated path now consumes the skb whose length was charged to the budget, preventing potential kernel panics on ordinary egress.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch for the sch_taprio component of the Linux kernel's net/sched module
• Monitor for potential kernel panics on ordinary egress
• Verify the fix is applied and test the network scheduling functionality
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was resolved by replacing the direct dequeue call with peek and qdisc_dequeue_peeked in the sch_taprio component of the Linux kernel's net/sched module. This change addresses issues with non-work-conserving child qdiscs, potentially preventing kernel panics. Linux kernel developers should verify the fix is applied and test network scheduling functionality. Evidence is limited to public CVE and NVD details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.