01 Record

CVE-2026-72035

net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

HighPUBLISHEDCNA: Linux

CNA base score8.2 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

View raw JSON

02 Description

net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.58% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 47.9% of scored records. A rank, not a probability.

NVD base score

8.2 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-15 05:51Z2 MO AGO

Last updated

2026-10-19 21:19Z9 DAYS AGO

Reserved

2026-08-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.2)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weaknesses

CWE-476NULL Pointer DereferenceBase

Data version

5.2

Document digest

63158f60cf8dcc9fab720d8ff6c192fe6d75574318e12f1b9b945d9a73cad412

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < 51f8af240aed903e988755af33d7491030b50ae9, 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < 17ab5f76f3899f67e5569722f334591f4b88b17b, 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < f60d5c12e0551012cee5c272b0bcbcc78f7bb506, 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < 6ee5a7665a9080bcb05d703bf981a579436fd05e, 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < 18d580cb00c55805633bae45e90cf22ed6b8e424, 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09, 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < 2dcebbd1ad2e180fe7b98bf346ced69a872e11e6, 5a781ccbd19e4664babcbe4b4ead7aa2b9283d22 to < e056e1dfcddca877dd46d704e8ec9860cfc9ec44, 4.20—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/51f8af240aed903e988755af33d7491030b50ae9
git.kernel.orghttps://git.kernel.org/stable/c/17ab5f76f3899f67e5569722f334591f4b88b17b
git.kernel.orghttps://git.kernel.org/stable/c/f60d5c12e0551012cee5c272b0bcbcc78f7bb506
git.kernel.orghttps://git.kernel.org/stable/c/6ee5a7665a9080bcb05d703bf981a579436fd05e
git.kernel.orghttps://git.kernel.org/stable/c/18d580cb00c55805633bae45e90cf22ed6b8e424
git.kernel.orghttps://git.kernel.org/stable/c/e2b7ee61989f2d39df6c2cc06f9db1aea69bdb09
git.kernel.orghttps://git.kernel.org/stable/c/2dcebbd1ad2e180fe7b98bf346ced69a872e11e6
git.kernel.orghttps://git.kernel.org/stable/c/e056e1dfcddca877dd46d704e8ec9860cfc9ec44

07 Fixed in

Debian 12

linux
Fixed in 6.1.187-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.