CVE-2026-53079 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net_sched: fix skb memory leak in deferred qdisc drops When the network stack cleans up the deferred list via qdisc_run_end(), it operates on the root qdisc. If the root qdisc do not implement the TCQ_F_DEQUEUE_DROPS flag the packets queue to free are never freed and gets stranded on the child's local to_free list. Fix this by making qdisc_dequeue_drop() aware of the root qdisc. It fetches the root qdisc and check for the TCQ_F_DEQUEUE_DROPS flag. If the flag is present, the packet is appended directly to the root's to_free list. Otherwise, drop it directly as it was done before the optimization was implemented.
A memory leak vulnerability has been identified in the Linux kernel's network scheduling component. When the network stack cleans up deferred packets, it does so using the root queue discipline (qdisc). If this root qdisc does not support the TCQ_F_DEQUEUE_DROPS flag, the packets intended to be freed remain unreleased, becoming trapped on the local 'to_free' list of child qdiscs. This issue has been addressed by modifying the qdisc_dequeue_drop() function to recognize the root qdisc. The function now checks for the TCQ_F_DEQUEUE_DROPS flag: if the flag is active, the packet is added to the root's 'to_free' list; if not, it is dropped as previously done before this optimization.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/a6bd339dbb3514bce690fdcf252e788dfab4ee76 | kernel.org | Patch |
| https://git.kernel.org/stable/c/bf26ad92ffda7884825d67b46bd5efe615c3babf | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | Initial Analysis | [email protected] |
| Jun 24, 2026 | New CVE Received | kernel.org |