CVE-2026-63983 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: fix packet loop on netem when duplicate is on
When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted.
The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking.
Use the skb tc_depth field introduced in an earlier patch: - increment it on the duplicate before re-enqueue - skip duplication for any skb whose tc_depth is already non-zero.
This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists within the Linux kernel's networking subsystem, specifically in the network emulation (netem) functionality that is part of the traffic control framework. The issue manifests when netem is configured to duplicate packets and operates within a hierarchical qdisc tree structure. When a packet is duplicated by netem, it re-enqueues the copy at the root qdisc level, creating a potential for recursive duplication if additional netem instances exist elsewhere in the traffic control tree. This recursive behavior can lead to infinite loops that consume system resources and potentially cause system instability or denial of service conditions.
The technical flaw stems from an inadequate duplication guard mechanism that was previously implemented by temporarily zeroing the q->duplicate field during packet re-enqueue operations. This approach proved insufficient because it relied on per-qdisc state that is shared across all concurrent enqueue paths, making it inherently unsafe without proper locking mechanisms. The original implementation failed to account for the complex concurrency scenarios that can occur in real-world network traffic control configurations where multiple threads or processes might simultaneously access the same qdisc instance.
The operational impact of this vulnerability is significant as it can lead to system resource exhaustion through stack overflow or memory exhaustion when packet duplication occurs recursively. Attackers could potentially exploit this by configuring malicious network traffic control policies that trigger the recursive duplication loop, leading to system instability, performance degradation, or complete system crashes. The vulnerability affects any Linux kernel version that implements netem functionality and is particularly concerning in environments where network emulation is heavily utilized for testing or development purposes.
The fix addresses this issue by utilizing the skb tc_depth field that was introduced in a previous patch, implementing a more robust approach to tracking packet duplication. The solution increments the tc_depth field on duplicated packets before re-enqueueing them, and subsequently skips duplication for any packet whose tc_depth field is already non-zero. This approach marks the packet itself rather than modifying shared qdisc state, making it inherently safe regardless of the tree topology or concurrent access patterns. This implementation follows security best practices by avoiding race conditions and state-based locking mechanisms that could introduce additional vulnerabilities while maintaining the intended functionality of netem duplication.
This vulnerability aligns with CWE-674 principle of "Uncontrolled Recursion" and demonstrates characteristics similar to those addressed in ATT&CK technique T1499.002 for network denial of service attacks. The fix represents a proper defensive programming approach that eliminates the need for shared state manipulation while preserving the core functionality of the traffic control system, thereby maintaining both security and operational integrity of the Linux networking stack.