Skip to main content

Linux Kernel EUVDEUVD-2026-38947

| CVE-2026-53079 MEDIUM
Memory Leak (CWE-401)
2026-06-24 Linux GHSA-8w4c-rp37-3wmc
Information Disclosure Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access with low privileges required to configure qdiscs; only availability is impacted via kernel memory leak, with no confidentiality or integrity consequence.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 23, 2026 - 21:01 vuln.today
CVSS changed
Jul 23, 2026 - 18:53 NVD
5.5 (MEDIUM)
CVE Published
Jun 24, 2026 - 16:30 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

net_sched: fix skb memory leak in deferred qdisc drops

When the network stack cleans up the deferred list via qdisc_run_end(), it operates on the root qdisc. If the root qdisc do not implement the TCQ_F_DEQUEUE_DROPS flag the packets queue to free are never freed and gets stranded on the child's local to_free list.

Fix this by making qdisc_dequeue_drop() aware of the root qdisc. It fetches the root qdisc and check for the TCQ_F_DEQUEUE_DROPS flag. If the flag is present, the packet is appended directly to the root's to_free list. Otherwise, drop it directly as it was done before the optimization was implemented.

AnalysisAI

Memory leak in the Linux kernel's network scheduler (net_sched) subsystem allows a local low-privileged user to exhaust kernel memory and degrade system availability. The flaw resides in qdisc_dequeue_drop(), which fails to account for root qdiscs that lack the TCQ_F_DEQUEUE_DROPS flag - leaving packet buffers stranded indefinitely on child qdisc to_free lists during qdisc_run_end() cleanup. No active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the low probability of opportunistic abuse given the local access and specific configuration requirements.

Technical ContextAI

Linux kernel network traffic control (tc/net_sched) organises packet queuing via queuing disciplines (qdiscs), which can be nested: a root qdisc may contain child qdiscs. An optimisation introduced before commit a6efc273ab82 allowed deferred packet freeing via a to_free list flushed in qdisc_run_end(). The bug (CWE-401, Missing Release of Memory after Effective Lifetime) is that qdisc_dequeue_drop() checked only the child qdisc for the TCQ_F_DEQUEUE_DROPS capability flag. When the root qdisc does not set this flag, the child accumulates freed-packet references on its local to_free list that are never drained, constituting a persistent kernel memory leak. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (scoped by commit range). The input tags list 'Information Disclosure', but the CVSS vector assigns C:N - this appears to be a tagging error; the actual impact is availability-only.

RemediationAI

Apply the upstream kernel fix via one of two stable-branch commits: https://git.kernel.org/stable/c/bf26ad92ffda7884825d67b46bd5efe615c3babf or https://git.kernel.org/stable/c/a6bd339dbb3514bce690fdcf252e788dfab4ee76. Ubuntu users should apply USN-8568-1 or USN-8566-1 through the standard package manager (apt-get update && apt-get upgrade linux-image). No exact fixed release version was independently confirmed beyond the stable commit references and patch series 7.0.10/7.1 per EUVD data. As a compensating control prior to patching, administrators can restrict creation and modification of tc qdisc configurations to root only (capability CAP_NET_ADMIN), preventing low-privileged users from establishing the nested qdisc topology required to trigger the leak. Note this restriction may impact legitimate QoS management workflows.

Same weakness CWE-401 – Memory Leak

View all
CVE-2020-13934 HIGH
7.5
CVE-2016-4232 HIGH POC
7.5
CVE-2024-25450 HIGH POC
8.8
CVE-2023-33718 HIGH POC
8.8
CVE-2019-6128 HIGH POC
8.8
CVE-2026-67183 HIGH POC
8.7
CVE-2023-34451 HIGH POC
8.2
CVE-2023-41484 HIGH POC
8.1

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

EUVD-2026-38947 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy