« Volver al listado

CVE-2026-72035

Estado: RecibidaAlta (8.2)—

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

When taprio's software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child ->dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child's qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child's stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:N/AC:L/PR:N indica exposición remota sin privilegios (T1190). Impacto: DoS (A:H) en kernel por desreferencia NULL desde softirq; escalada potencial si el panic es explotable localmente.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability ScanningThreat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-72035",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "51f8af240aed903e988755af33d7491030b50ae9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "17ab5f76f3899f67e5569722f334591f4b88b17b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "f60d5c12e0551012cee5c272b0bcbcc78f7bb506",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "6ee5a7665a9080bcb05d703bf981a579436fd05e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "18d580cb00c55805633bae45e90cf22ed6b8e424",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "2dcebbd1ad2e180fe7b98bf346ced69a872e11e6",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5a781ccbd19e4664babcbe4b4ead7aa2b9283d22",
              "lessThan": "e056e1dfcddca877dd46d704e8ec9860cfc9ec44",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/sched/sch_taprio.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.20"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.20",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/sched/sch_taprio.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-15T06:21:12.497",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/17ab5f76f3899f67e5569722f334591f4b88b17b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/18d580cb00c55805633bae45e90cf22ed6b8e424",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2dcebbd1ad2e180fe7b98bf346ced69a872e11e6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/51f8af240aed903e988755af33d7491030b50ae9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/6ee5a7665a9080bcb05d703bf981a579436fd05e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e056e1dfcddca877dd46d704e8ec9860cfc9ec44",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f60d5c12e0551012cee5c272b0bcbcc78f7bb506",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked\n\nWhen taprio's software path peeks a non-work-conserving child qdisc, the\nchild stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq()\nthen takes the packet with a direct child ->dequeue() call, which ignores\nthat stash, orphans the peeked skb and desyncs the child's qlen/backlog.\nWith a qfq child this re-enters the child on an emptied list and\ndereferences NULL, panicking the kernel from softirq on ordinary egress.\n\nTake the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb\nnow do. The helper returns the child's stashed skb first and is a no-op\nwhen there is none, so a work-conserving child is unaffected and the\ngated path now consumes the skb whose length was charged to the budget."
    }
  ],
  "lastModified": "2026-08-23T13:16:37.730",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}