CVE-2026-52997 net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()
A local attacker can cause a kernel crash by triggering a NULL pointer dereference in the dualpi2 qdisc when reducing limits while packets are queued in the L-queue.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52997?
CVE-2026-52997 is a medium-severity vulnerability in Linux kernel, published on 24 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()
Fix dualpi2_change() to correctly enforce updated limit and memlimit values after a configuration change of the dualpi2 qdisc.
Before this patch, dualpi2_change() always attempted to dequeue packets via the root qdisc (C-queue) when reducing backlog or memory usage, and unconditionally assumed that a valid skb will be returned. When traffic classification results in packets being queued in the L-queue while the C-queue is empty, this leads to a NULL skb dereference during limit or memlimit enforcement.
This is fixed by first dequeuing from the C-queue path if it is non-empty. Once the C-queue is empty, packets are dequeued directly from the L-queue. Return values from qdisc_dequeue_internal() are checked for both queues. When dequeuing from the L-queue, the parent qdisc qlen and backlog counters are updated explicitly to keep overall qdisc statistics consistent.
Weakness: CWE-476
Which versions are affected by CVE-2026-52997?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-52997?
Apply the vendor's patch.
Is CVE-2026-52997 being exploited?
There is no known exploitation of CVE-2026-52997 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-52997, DEBIAN-CVE-2026-52997, GHSA-qc77-246g-gj7g, UBUNTU-CVE-2026-52997.