CVE-2026-64207 in Linux
Summary
by MITRE • 07/20/2026
In the Linux kernel, the following vulnerability has been resolved:
net/sched: dualpi2: fix GSO backlog accounting
When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NET_XMIT_SUCCESS. The parent then accounts for the original skb once more, leaving its qlen one larger than the number of packets actually queued.
With QFQ as the parent, after all real packets are dequeued, QFQ still has a non-zero qlen while its in-service aggregate has no active classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes the result to qfq_peek_skb(), causing a NULL pointer dereference.
Follow the same pattern used by tbf_segment() and taprio: count only successfully queued segments, propagate the difference between the original skb and those segments, and return NET_XMIT_SUCCESS whenever at least one segment was queued.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in the linux kernel's networking subsystem within the net/sched directory where the dualpi2 traffic control queueing discipline handles generic segmentation offload operations. The flaw manifests when DualPI2 processes a generic segmentation offload skb by splitting it into multiple segments for transmission. During this process, the implementation incorrectly propagates additional packets to the parent queueing discipline before returning success status, creating an accounting discrepancy that affects the overall packet queue length calculation.
The technical implementation error stems from improper handling of the packet backlog accounting mechanism within the dualpi2 subsystem. When splitting a gso packet into N segments, the code erroneously increments the parent's packet count by N additional packets before the original skb is properly accounted for. This double counting results in a queue length that exceeds the actual number of packets present in the system, creating a state inconsistency between what the queue manager believes is queued versus reality.
The operational impact becomes critical when this faulty accounting interacts with the queuing function fairness qfq algorithm which serves as the parent queueing discipline. When all real packets have been successfully dequeued from the system, the qfq scheduler maintains a non-zero queue length while its in-service aggregate contains no active classes. This anomalous state triggers qfq_choose_next_agg() to return a null pointer, subsequently passing this null value to qfq_peek_skb() which causes a kernel panic through null pointer dereference.
This vulnerability aligns with common software security principles regarding resource management and state consistency within kernel space operations. The issue demonstrates poor adherence to standard queueing discipline patterns that other similar implementations like tbf_segment() and taprio follow correctly. These established patterns properly account for only successfully queued segments, maintain accurate propagation counts between parent and child queueing disciplines, and ensure proper return codes indicating successful packet processing even when multiple segments are involved.
The fix implements a standardized approach consistent with industry best practices for kernel networking components. By counting only the actually successfully queued segments rather than propagating all potential segments upfront, the implementation maintains proper accounting integrity throughout the queueing process. This solution follows established patterns within the linux kernel networking stack and prevents the null pointer dereference condition that would otherwise occur during scheduler operations.
Security implications extend beyond immediate system stability to include potential denial of service scenarios where malicious packet injection could trigger repeated null pointer dereferences. The vulnerability represents a classic case of improper state management in kernel space, similar to issues classified under common weakness enumeration categories related to resource management and memory safety. This flaw demonstrates why adherence to established patterns and careful accounting of network packet processing is essential for maintaining kernel stability and preventing exploitation opportunities.