CVE-2026-53079: net_sched: fix skb memory leak in deferred qdisc drops
In the Linux kernel, the following vulnerability has been resolved:
netsched: fix skb memory leak in deferred qdisc drops
When the network stack cleans up the deferred list via qdiscrunend(), it operates on the root qdisc. If the root qdisc do not implement the TCQFDEQUEUEDROPS flag the packets queue to free are never freed and gets stranded on the child's local tofree list.
Fix this by making qdiscdequeuedrop() aware of the root qdisc. It fetches the root qdisc and check for the TCQFDEQUEUEDROPS flag. If the flag is present, the packet is appended directly to the root's tofree list. Otherwise, drop it directly as it was done before the optimization was implemented.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53079?
CVE-2026-53079 has a risk rating of 12, indicating a high severity vulnerability.
How do I fix CVE-2026-53079?
To fix CVE-2026-53079, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What systems are affected by CVE-2026-53079?
CVE-2026-53079 affects Linux kernel versions that utilize the network stack with deferred qdisc drops.
What are the potential impacts of CVE-2026-53079?
The potential impacts of CVE-2026-53079 include a memory leak which can lead to performance degradation of the network stack.
Is there a workaround for CVE-2026-53079?
Currently, the best approach for mitigating CVE-2026-53079 is to apply the official kernel patch or to upgrade to an unaffected version.