CVE-2026-72036: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked

multiq_dequeue() takes a packet from a band's child with a direct
->dequeue() call after multiq_peek() peeked it. When the child is
non-work-conserving the peek stashes the skb in the child's gso_skb, so
the direct dequeue returns a different skb and orphans the stash,
desyncing the child's qlen/backlog. With a qfq child reached through a
peeking parent (e.g. tbf) this re-enters the child on an emptied list and
dereferences NULL, panicking the kernel from softirq on ordinary egress.

Take the packet through qdisc_dequeue_peeked(), as sch_prio already does
and as sch_red and sch_sfb were just fixed to do. The helper is a no-op
when the child has no stash, so a work-conserving child is unaffected.

The Linux kernel CVE team has assigned CVE-2026-72036 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 5.10.261 with commit 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a
	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 5.15.212 with commit eb1a9637f0bd84b5db8803af65dfb1f44785406f
	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 6.1.178 with commit 7a5a1582710981ef6637de9f074a60a5b1d63222
	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 6.6.145 with commit 86a61e46a1919e8abf4d227c204773dabb24068a
	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 6.12.97 with commit 1b9cc255e8089606b92b2adf504e334573682821
	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 6.18.40 with commit 5889064919a1e5c0a9469c54895000414fc46944
	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 7.1.5 with commit fffeb2ab5eeb823d4c2330571a098f63237c9049
	Issue introduced in 2.6.29 with commit 77be155cba4e163e8bba9fd27222a8b6189ec4f7 and fixed in 7.2-rc2 with commit 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72036
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sched/sch_multiq.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a
	https://git.kernel.org/stable/c/eb1a9637f0bd84b5db8803af65dfb1f44785406f
	https://git.kernel.org/stable/c/7a5a1582710981ef6637de9f074a60a5b1d63222
	https://git.kernel.org/stable/c/86a61e46a1919e8abf4d227c204773dabb24068a
	https://git.kernel.org/stable/c/1b9cc255e8089606b92b2adf504e334573682821
	https://git.kernel.org/stable/c/5889064919a1e5c0a9469c54895000414fc46944
	https://git.kernel.org/stable/c/fffeb2ab5eeb823d4c2330571a098f63237c9049
	https://git.kernel.org/stable/c/54f6b0c843e228d499eb4b6bbb89df68cad9ad5d