CVE-2026-64207
Received Received - Intake

NULL Pointer Dereference in Linux Kernel DualPI2 Scheduler

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: dualpi2: fix GSO backlog accounting When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NET_XMIT_SUCCESS. The parent then accounts for the original skb once more, leaving its qlen one larger than the number of packets actually queued. With QFQ as the parent, after all real packets are dequeued, QFQ still has a non-zero qlen while its in-service aggregate has no active classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes the result to qfq_peek_skb(), causing a NULL pointer dereference. Follow the same pattern used by tbf_segment() and taprio: count only successfully queued segments, propagate the difference between the original skb and those segments, and return NET_XMIT_SUCCESS whenever at least one segment was queued.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-64207
EUVD
EUVD-2026-46015

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where DualPI2 incorrectly accounts for network packet segments during GSO processing. When splitting a packet into multiple segments, it reports more packets to the parent queue than actually exist, causing a mismatch in queue length tracking. This leads to a NULL pointer dereference when the parent queue (QFQ) tries to process an empty queue.

Detection Guidance

This vulnerability is specific to the Linux kernel's DualPI2 traffic control implementation and may not have direct detection commands. Monitor kernel logs for NULL pointer dereference errors in QFQ or DualPI2 modules. Check for unusual queue length mismatches in traffic control classes using commands like 'tc -s qdisc show' or 'tc -s class show'. If QFQ is used as a parent qdisc, verify qlen values do not exceed actual packet counts.

Impact Analysis

This vulnerability could cause system crashes due to kernel NULL pointer dereference, leading to denial of service. Network performance may degrade as packet queues become miscounted. Systems using QFQ or DualPI2 in network traffic management could experience instability or unexpected failures.

Compliance Impact

This vulnerability is a kernel-level network packet scheduling issue that could lead to a NULL pointer dereference in the Linux kernel's QFQ scheduler. It does not directly impact data privacy, security controls, or compliance with standards like GDPR or HIPAA, as it is not related to data handling, encryption, or access control mechanisms.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64207. Monitor kernel security advisories and apply updates promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart