Executive brief
A vulnerability in the Linux kernel's networking component could allow a system crash. The issue occurs when the system incorrectly tracks network data packets during processing, leading to a memory error. This could result in a denial-of-service condition, impacting the availability of the affected server or device.
Technical details
A vulnerability exists in the net/sched/sch_dualpi2.c component of the Linux kernel due to incorrect Generic Segmentation Offload (GSO) backlog accounting. When DualPI2 splits a GSO socket buffer (skb) into multiple segments, it incorrectly increments the packet count (qlen) in the parent qdisc. If a parent qdisc like QFQ (Quick Fair Queueing) is used, this mismatch results in a non-zero qlen even after all packets are dequeued. Subsequent calls to qfq_dequeue() then pass a NULL pointer to qfq_peek_skb(), triggering a kernel panic. The fix involves correctly calculating the difference between the original skb and the resulting segments using qdisc_tree_reduce_backlog().
Affected products
- Linux Linux Kernel 6.17 to 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-06-19: patched: Initial fix commit in Linux kernel source
- 2026-07-20: disclosed: CVE-2026-64207 published