Executive brief
The Linux kernel's network packet scheduling layer contains a bug in the multiq (multi-queue) scheduler that can crash the kernel when certain queue configurations are used. When a non-work-conserving queue discipline is combined with specific parent schedulers, a packet dequeue operation can trigger a NULL pointer dereference, causing the kernel to panic and making the system unavailable.
Technical details
The vulnerability exists in the multiq_dequeue() function in net/sched/sch_multiq.c, where a direct qdisc->dequeue() call is made after multiq_peek() has peeked at a packet. When the child queue discipline is non-work-conserving, the peek operation stashes the skb in the child's gso_skb buffer. The subsequent direct dequeue returns a different packet and orphans the stashed one, causing the child's qlen/backlog counters to become desynchronized. When a QFQ child queue is reached through a peeking parent scheduler (such as tbf), this re-enters the child on an emptied list and dereferences a NULL pointer, panicking the kernel from softirq context during ordinary network egress operations. The fix replaces the direct dequeue call with qdisc_dequeue_peeked(), which properly handles the stashed packet and acts as a no-op for work-conserving children.
Affected products
- Linux Linux Kernel multiple versions from 2.6.11.y through 7.2.y and rolling versions
Timeline
- 2026-08-15: disclosed
- 2026-06-25: patched