CVE-2026-72036

A flaw was found in the Linux kernel's sch_multiq component, which handles network packet scheduling. This vulnerability occurs when a non-work-conserving child queue is improperly handled after a packet has been temporarily stored. This can lead to a desynchronization of network packet queues and a null pointer dereference. An attacker could exploit this by sending specially crafted network traffic, causing the kernel to panic and resulting in a Denial of Service (DoS).

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering the crash requires specific network scheduling configurations that typically necessitate elevated administrative privileges, restricting the blast radius to a local denial of service. Standard installations do not enable the multiq queuing discipline by default, meaning an attacker must possess CAP_NET_ADMIN privileges or access to network namespaces to establish the vulnerable nested queue topology. Because the flaw only results in a system crash via a null pointer dereference during packet dequeue operations, confidentiality and system integrity are not impacted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.