Linux Kernel Netem Queue Limit Bypass

Publication date: 2026-06-24

Last updated on: 2026-07-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: fix queue limit check to include reordered packets The queue limit check in netem_enqueue() uses q->t_len which only counts packets in the internal tfifo. Packets placed in sch->q by the reorder path (__qdisc_enqueue_head) are not counted, allowing the total queue occupancy to exceed sch->limit under reordering. Include sch->q.qlen in the limit check.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-14

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-13

NVD

CVE-2026-52984

EUVD

EUVD-2026-38852

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.13
linux	linux_kernel	6.13
linux	linux_kernel	6.13
linux	linux_kernel	6.13
linux	linux_kernel	6.13
linux	linux_kernel	6.13
linux	linux_kernel	From 5.4.288 (inc) to 5.5 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.10.232 (inc) to 5.10.258 (exc)
linux	linux_kernel	From 5.15.175 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.1.121 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.12.6 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13.1 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.6.67 (inc) to 6.6.141 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's network scheduler component called netem. Specifically, the issue is in the queue limit check within the netem_enqueue() function. The check only counts packets in an internal queue (tfifo) but does not account for packets that have been reordered and placed in another queue (sch->q) by the reorder path (__qdisc_enqueue_head). Because of this, the total number of packets in the queue can exceed the configured limit, potentially causing unexpected behavior.

Impact Analysis

The vulnerability allows the total queue occupancy to exceed its intended limit due to improper counting of reordered packets. This could lead to network performance degradation, such as increased latency or packet loss, because the queue may become overloaded beyond its configured capacity.

Hi! I’m here to help you understand CVE-2026-52984. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70