Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs when changing configuration settings for a specific type of network traffic management (dualpi2 qdisc). If the system is processing certain types of network traffic during this configuration change, it may encounter a fatal error (NULL pointer dereference) leading to a system crash or denial of service.
Technical details
A vulnerability exists in the dualpi2_change() function within net/sched/sch_dualpi2.c of the Linux kernel. The function fails to account for packets residing in the L-queue when enforcing new memory or backlog limits during a qdisc configuration change. Specifically, it unconditionally attempts to dequeue from the C-queue (root qdisc); if the C-queue is empty but the L-queue contains packets, the function receives a NULL socket buffer (skb) and subsequently dereferences it. This results in a kernel panic. The fix involves correctly checking and draining both the C-queue and L-queue paths and validating the return values of qdisc_dequeue_internal().
Affected products
- Linux Linux 6.17 to 6.18.33, 7.0.10, 7.1
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory