Executive brief
A vulnerability in the Linux kernel's network emulation component (netem) could allow a system to crash or become unresponsive. This component is typically used by developers and administrators to simulate network conditions like packet loss or duplication. If misconfigured or exploited, it can cause an infinite loop of packet duplication that exhausts the system's memory or processing power, leading to a denial-of-service.
Technical details
A vulnerability in net/sched/sch_netem.c in the Linux kernel occurs when the netem qdisc is configured to duplicate packets. When a packet is duplicated, it is re-enqueued at the root qdisc; if multiple netem instances exist in the tree, this can lead to infinite recursion. The previous mitigation, which temporarily zeroed the duplication state, was insufficient due to a lack of locking in concurrent enqueue paths. The fix introduces the use of the 'tc_depth' field in the socket buffer (skb) to track and limit duplication depth, ensuring that already-duplicated packets are not processed again. This prevents the kernel from exhausting memory or stack space, which would otherwise result in a system crash.
Affected products
- Linux Linux 2.6.12 to 6.12.93, 7.0.12
Timeline
- 2026-05-25: other: Patch authored
- 2026-07-19: disclosed: CVE published