CVE-2026-64207 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NET_XMIT_SUCCESS. The parent then accounts for the original skb once more, leaving its qlen one larger than the number of packets actually queued. With QFQ as the parent, after all real packets are dequeued, QFQ still has a non-zero qlen while its in-service aggregate has no active classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes the result to qfq_peek_skb(), causing a NULL pointer dereference. Follow the same pattern used by tbf_segment() and taprio: count only successfully queued segments, propagate the difference between the original skb and those segments, and return NET_XMIT_SUCCESS whenever at least one segment was queued.
A vulnerability in the Linux kernel's DualPI2 queuing discipline can cause a NULL pointer dereference. When DualPI2 splits a Generic Segmentation Offload (GSO) socket buffer into multiple segments, it sends additional packets to its parent queueing discipline before returning a success status. This results in the parent incorrectly accounting for the number of packets, creating a discrepancy in the queue length. Specifically, when the parent is the Queue Fairness Queueing (QFQ) discipline, it can end up with a non-zero queue length while no active classes are available, leading to a NULL pointer dereference. The vulnerability arises from improper handling of the segmentation process, allowing the queueing discipline to become desynchronized with the actual packet flow.
The vulnerability has been addressed in the Linux kernel. Users should upgrade to the latest version available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/05ed733b65ab977dd931e7f7ac0f62fdb81205c2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/806586e33891066487db1f002be3d455cda6b516 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c4b70c1512b8f9f33f23c2c8196dfd1210207681 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.17, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 11, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | New CVE Received | kernel.org |