NULL pointer dereference in Linux kernel - CVE-2026-72035
Published: August 16, 2026
Vulnerability identifier: #VU143558
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-72035
CWE-ID: CWE-476
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the sch_taprio scheduler when processing ordinary egress through a non-work-conserving child qdisc after a peeked packet is orphaned and queue state is desynchronized. A local attacker can trigger network egress through a qfq child to cause a denial of service.
The issue can panic the kernel from softirq, and the qfq child can be re-entered on an emptied list.
Affected software
Linux kernel
How to mitigate CVE-2026-72035
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
External References
- https://git.kernel.org/stable/c/18d580cb00c55805633bae45e90cf22ed6b8e424
- https://git.kernel.org/stable/c/2dcebbd1ad2e180fe7b98bf346ced69a872e11e6
- https://git.kernel.org/stable/c/6ee5a7665a9080bcb05d703bf981a579436fd05e
- https://git.kernel.org/stable/c/e056e1dfcddca877dd46d704e8ec9860cfc9ec44
- https://git.kernel.org/stable/c/e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09