Junglewise Threat Intelligence

CVE-2026-52997: Linux kernel NULL pointer dereference in sch_dualpi2 network scheduler

CVE-2026-52997 · Severity: info · CVSS 5.5 · Published 2026-06-24

Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to crash the system. The issue occurs when changing configuration settings for a specific type of network traffic management (dualpi2 qdisc). If the system is processing certain types of network traffic during this configuration change, it may encounter a fatal error (NULL pointer dereference) leading to a system crash or denial of service.

Technical details

A vulnerability exists in the dualpi2_change() function within net/sched/sch_dualpi2.c of the Linux kernel. The function fails to account for packets residing in the L-queue when enforcing new memory or backlog limits during a qdisc configuration change. Specifically, it unconditionally attempts to dequeue from the C-queue (root qdisc); if the C-queue is empty but the L-queue contains packets, the function receives a NULL socket buffer (skb) and subsequently dereferences it. This results in a kernel panic. The fix involves correctly checking and draining both the C-queue and L-queue paths and validating the return values of qdisc_dequeue_internal().

Affected products

  • Linux Linux 6.17 to 6.18.33, 7.0.10, 7.1

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References