Executive brief
A vulnerability in the Linux kernel's network emulation component could allow network traffic to bypass configured queue limits. This component is typically used for testing network conditions like delay and packet loss. If exploited, an attacker could cause the system to consume more memory than intended for network buffers, potentially leading to performance degradation or a denial-of-service condition.
Technical details
A vulnerability was identified in net/sched/sch_netem.c where the netem_enqueue() function incorrectly validates queue limits. The check originally relied on q->t_len, which only tracks packets in the internal FIFO. However, packets handled via the reorder path (__qdisc_enqueue_head) are placed in sch->q and were not being counted against the limit. This allows total queue occupancy to exceed the configured sch->limit when packet reordering is active. An attacker could potentially exploit this to cause excessive kernel memory consumption. The fix updates the check to use sch->q.qlen, ensuring all packets in the queue are accounted for.
Affected products
- Linux Linux Kernel 5.10.232 to 5.10.258, 5.15.175 to 5.15.209, 6.1.121 to 6.1.175, 6.6.67 to 6.6.141, 6.12.6 to 6.12.91
Timeline
- 2026-04-17: disclosed: Patch authored by Stephen Hemminger
- 2026-06-24: advisory: CVE-2026-52984 published by NVD
References
- https://git.kernel.org/stable/c/0f875d52db4c921da610e481b72f03cc82fdcb72
- https://git.kernel.org/stable/c/39a66e83ea41fe845631eeb8d326953de27d13f9
- https://git.kernel.org/stable/c/4185701fcce6b426b6c3630b25330dddd9c47b0d
- https://git.kernel.org/stable/c/54b5dbacd00dedffd5e2eed76de1c3839996b5e6
- https://git.kernel.org/stable/c/74fcd8e127200a50ee22ba2b45c164722bdb9177
- https://git.kernel.org/stable/c/8450462eaf91d5d2a9e863507b16d18e814baef3
- https://git.kernel.org/stable/c/936a7dd87251f6f3e88983350833edf60fe6a80b