CVE-2026-64207: net/sched: dualpi2: fix GSO backlog accounting
In the Linux kernel, the following vulnerability has been resolved:
net/sched: dualpi2: fix GSO backlog accounting
When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NETXMITSUCCESS. The parent then accounts for the original skb once more, leaving its qlen one larger than the number of packets actually queued.
With QFQ as the parent, after all real packets are dequeued, QFQ still has a non-zero qlen while its in-service aggregate has no active classes. qfqchoosenextagg() returns NULL and qfqdequeue() passes the result to qfqpeekskb(), causing a NULL pointer dereference.
Follow the same pattern used by tbfsegment() and taprio: count only successfully queued segments, propagate the difference between the original skb and those segments, and return NETXMITSUCCESS whenever at least one segment was queued.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64207?
The severity of CVE-2026-64207 is rated as 34.
How do I fix CVE-2026-64207?
To fix CVE-2026-64207, upgrade to the latest patched version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-64207?
CVE-2026-64207 affects Linux kernel implementations utilizing the dualpi2 scheduling mechanism.
What type of vulnerability is CVE-2026-64207?
CVE-2026-64207 is classified as a Null Pointer Dereference vulnerability.
Can CVE-2026-64207 lead to system crashes?
Yes, CVE-2026-64207 can potentially lead to system instability or crashes due to improper handling of GSO segment propagation.