Vulnerability-Lookup

GHSA-RJ36-QXVM-R8RM

Vulnerability from github – Published: 2026-07-19 18:31 – Updated: 2026-07-19 18:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: fix packet loop on netem when duplicate is on

When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted.

The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking.

Use the skb tc_depth field introduced in an earlier patch: - increment it on the duplicate before re-enqueue - skip duplication for any skb whose tc_depth is already non-zero.

This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-63983"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-19T16:17:17Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q-\u003eduplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency.",
  "id": "GHSA-rj36-qxvm-r8rm",
  "modified": "2026-07-19T18:31:48Z",
  "published": "2026-07-19T18:31:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63983"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-63983 (GCVE-0-2026-63983)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-07-19 14:56

Title

net/sched: fix packet loop on netem when duplicate is on

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking. Use the skb tc_depth field introduced in an earlier patch: - increment it on the duplicate before re-enqueue - skip duplication for any skb whose tc_depth is already non-zero. This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency.

Severity

No CVSS data available.

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/1a298a514ce766c6d…
https://git.kernel.org/stable/c/cfb2616042767ab31…
https://git.kernel.org/stable/c/9552b11e3edabc97c…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0afb51e72855971dba83b3c6b70c547c2d1161fd , < 1a298a514ce766c6d0c232991a390fec67af81ad (git) Affected: 0afb51e72855971dba83b3c6b70c547c2d1161fd , < cfb2616042767ab31260d4f39190c381bec8b12e (git) Affected: 0afb51e72855971dba83b3c6b70c547c2d1161fd , < 9552b11e3edabc97cfcd9f29103d5afbce7ae183 (git)
Linux	Linux	Affected: 2.6.12 Unaffected: 0 , < 2.6.12 (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_netem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1a298a514ce766c6d0c232991a390fec67af81ad",
              "status": "affected",
              "version": "0afb51e72855971dba83b3c6b70c547c2d1161fd",
              "versionType": "git"
            },
            {
              "lessThan": "cfb2616042767ab31260d4f39190c381bec8b12e",
              "status": "affected",
              "version": "0afb51e72855971dba83b3c6b70c547c2d1161fd",
              "versionType": "git"
            },
            {
              "lessThan": "9552b11e3edabc97cfcd9f29103d5afbce7ae183",
              "status": "affected",
              "version": "0afb51e72855971dba83b3c6b70c547c2d1161fd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/sch_netem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q-\u003eduplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-19T14:56:06.047Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad"
        },
        {
          "url": "https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"
        }
      ],
      "title": "net/sched: fix packet loop on netem when duplicate is on",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63983",
    "datePublished": "2026-07-19T14:56:06.047Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-07-19T14:56:06.047Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-RJ36-QXVM-R8RM

CVE-2026-63983 (GCVE-0-2026-63983)

Tags

Sightings

Nomenclature