CyberSecBulletin
CVE-2026-72036NVD status: Received

Linux: NULL Pointer Dereference

Published Updated By the CyberSecBulletin desk

CVE-2026-72036 is a high-severity NULL pointer dereference vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a, eb1a9637f0bd84b5db8803af65dfb1f44785406f, 7a5a1582710981ef6637de9f074a60a5b1d63222 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.17% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a or eb1a9637f0bd84b5db8803af65dfb1f44785406f or 7a5a1582710981ef6637de9f074a60a5b1d63222 or 86a61e46a1919e8abf4d227c204773dabb24068a, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, 3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, eb1a9637f0bd84b5db8803af65dfb1f44785406f; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, 7a5a1582710981ef6637de9f074a60a5b1d63222; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, 86a61e46a1919e8abf4d227c204773dabb24068a; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, 1b9cc255e8089606b92b2adf504e334573682821; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, 5889064919a1e5c0a9469c54895000414fc46944; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, fffeb2ab5eeb823d4c2330571a098f63237c9049; 77be155cba4e163e8bba9fd27222a8b6189ec4f7 up to, but not including, 54f6b0c843e228d499eb4b6bbb89df68cad9ad5d; and 1 more ranges3e5fd9d14f2d228e7260251f2e4a1d41ba8f705a, eb1a9637f0bd84b5db8803af65dfb1f44785406f, 7a5a1582710981ef6637de9f074a60a5b1d63222, 86a61e46a1919e8abf4d227c204773dabb24068a, 1b9cc255e8089606b92b2adf504e334573682821, 5889064919a1e5c0a9469c54895000414fc46944

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_multiq: Replace direct dequeue call with peek and qdisc_dequeue_peeked multiq_dequeue() takes a packet from a band's child with a direct ->dequeue() call after multiq_peek() peeked it. When the child is non-work-conserving the peek stashes the skb in the child's gso_skb, so the direct dequeue returns a different skb and orphans the stash, desyncing the child's qlen/backlog. With a qfq child reached through a peeking parent (e.g. tbf) this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_prio already does and as sch_red and sch_sfb were just fixed to do. The helper is a no-op when the child has no stash, so a work-conserving child is unaffected.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

How developers prevent this class of flaw

  • For any pointers that could have been modified or provided from a function that can return NULL, check the pointer for NULL before use. When working with a multithreaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the check, and unlock when it has finished.
  • Select a programming language that is not susceptible to these issues.
  • Check the results of all functions that return a value and verify that the value is non-null before acting upon it.

More NULL Pointer Dereference vulnerabilities (CWE-476)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent NULL Pointer Dereference vulnerabilities

Spotted an error? Tell us.