Denial of Service Vulnerability in Linux Kernel's Network Scheduling Component

CVE-2026-63983

What is CVE-2026-63983?

A vulnerability in the Linux kernel's network scheduling feature could lead to a denial of service via unintended packet duplication. When the netem functionality duplicates a packet, it re-enqueues the copied packet at the root qdisc. This can trigger a recursive duplication if another netem is present in the hierarchy, potentially exhausting system memory or stack resources. The initial duplication protection mechanism failed in handling all cases due to shared state across concurrent enqueue paths. A fix has been implemented that uses the skb tc_depth field to track duplicate packets, allowing for safe handling by skipping duplicates when their tc_depth is non-zero, thereby enhancing stability and performance in concurrent environments.

References