Skip to main content

Linux Kernel CVE-2026-52997

| EUVDEUVD-2026-38865 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-qc77-246g-gj7g
Linux Denial Of Service Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with CAP_NET_ADMIN (PR:L) required to reconfigure qdisc; no confidentiality or integrity impact, only availability via kernel panic.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 15, 2026 - 15:16 vuln.today
CVSS changed
Jul 15, 2026 - 13:07 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()

Fix dualpi2_change() to correctly enforce updated limit and memlimit values after a configuration change of the dualpi2 qdisc.

Before this patch, dualpi2_change() always attempted to dequeue packets via the root qdisc (C-queue) when reducing backlog or memory usage, and unconditionally assumed that a valid skb will be returned. When traffic classification results in packets being queued in the L-queue while the C-queue is empty, this leads to a NULL skb dereference during limit or memlimit enforcement.

This is fixed by first dequeuing from the C-queue path if it is non-empty. Once the C-queue is empty, packets are dequeued directly from the L-queue. Return values from qdisc_dequeue_internal() are checked for both queues. When dequeuing from the L-queue, the parent qdisc qlen and backlog counters are updated explicitly to keep overall qdisc statistics consistent.

AnalysisAI

NULL pointer dereference in the Linux kernel's sch_dualpi2 queuing discipline (net/sched) allows a local attacker with low privileges to crash the kernel, causing a denial of service. The flaw exists in dualpi2_change(), which enforces updated queue limits after a qdisc reconfiguration: when traffic is exclusively queued in the L-queue and the C-queue is empty, the function unconditionally dereferences the NULL skb returned by the C-queue dequeue path, triggering a kernel panic. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), consistent with a locally-triggered, configuration-dependent kernel bug.

Technical ContextAI

The DualPI2 (Dual Queue Proportional Integral controller Improved) algorithm is a Linux traffic control queuing discipline (qdisc) implementing an Active Queue Management scheme that separates traffic into two internal queues: C-queue (classic, delay-tolerant flows) and L-queue (low-latency flows such as L4S-marked traffic). The affected code path is dualpi2_change(), invoked when an operator modifies qdisc parameters such as limit or memlimit via tc-qdisc tooling. The function is responsible for draining excess packets to comply with the newly applied constraints. CWE-476 (NULL Pointer Dereference) is the root cause: the pre-patch code always dequeued from the root (C-queue) path and assumed a valid skb would be returned, never accounting for the case where C-queue is empty but L-queue is not. The missing NULL-return check combined with missing L-queue drain logic allowed this invalid dereference. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across the kernel stable trees prior to the fix commits.

RemediationAI

The primary fix is to upgrade to a patched stable kernel release: Linux 6.18.33, 7.0.10, or 7.1, which incorporate the upstream fix commits (https://git.kernel.org/stable/c/86cf2eba2056bcf9c41fba260e599bd95bf9943b, https://git.kernel.org/stable/c/3042add80c2c50bd127d570b83319af612efde65, https://git.kernel.org/stable/c/478ed6b7d2577439c610f91fa8759a4c878a4264). Distribution-specific kernel updates from vendors such as Red Hat, Debian, Ubuntu, and SUSE should be applied as they become available. As a compensating control where patching is not immediately possible, operators can remove any dualpi2 qdisc configurations ('tc qdisc del dev <iface> root' or similar) and substitute an alternative AQM such as fq_codel or cake; this eliminates the vulnerable code path entirely with minimal traffic-shaping trade-off. Additionally, in environments where container or namespace isolation is in use, restricting CAP_NET_ADMIN grants (via seccomp profiles, Kubernetes PodSecurityAdmission, or AppArmor/SELinux policies) prevents tenant-controlled qdisc reconfiguration and mitigates exploitation without requiring a kernel upgrade.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-52997 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy