CVE-2026-52984: Linux Kernel netem DOS Vulnerability

CVE-2026-52984 Overview

CVE-2026-52984 is a vulnerability in the Linux kernel's network emulator (netem) queueing discipline. The flaw resides in the netem_enqueue() function within net/sched/sch_netem.c. The queue limit check uses q->t_len, which only counts packets held in the internal time-indexed FIFO (tfifo). Packets that the reorder path routes through __qdisc_enqueue_head into sch->q are not counted against the limit. As a result, the total queue occupancy can exceed the configured sch->limit when reordering is active. The fix includes sch->q.qlen in the limit check so both queues are counted.

Critical Impact
Local users with CAP_NET_ADMIN who can configure netem qdiscs with reorder probability may cause unbounded queue growth, leading to excess kernel memory consumption and potential denial of service.

Affected Products

Linux kernel versions containing the netem qdisc reorder path prior to the fixing commits
Distributions shipping the affected stable kernel trees referenced by the upstream commits
Systems using tc qdisc with netem and a non-zero reorder probability

Discovery Timeline

2026-06-24 - CVE-2026-52984 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52984

Vulnerability Analysis

The netem qdisc emulates network characteristics such as delay, loss, duplication, and packet reordering. Inside netem_enqueue(), the kernel enforces a configured queue length boundary by comparing the current occupancy against sch->limit. The original check only consulted q->t_len, the counter for the internal time-indexed FIFO (tfifo) used to schedule delayed packets.

When the reorder feature is enabled, selected packets bypass the tfifo and are inserted at the head of the parent qdisc queue via __qdisc_enqueue_head. Those packets are tracked in sch->q.qlen rather than q->t_len. Because the limit check never inspected sch->q.qlen, the combined occupancy of both queues could exceed sch->limit without triggering a drop. This permits unbounded queue growth proportional to traffic volume and reorder probability.

The patch updates the check to consider both counters, ensuring the enqueue path drops packets once the sum of q->t_len and sch->q.qlen reaches the configured boundary. EPSS data lists the exploitation probability at 0.184%.

Root Cause

The root cause is an incomplete accounting check in netem_enqueue(). The function tracks two distinct storage locations for queued packets but only validated one against the configured limit. This is an input validation and resource boundary defect in kernel networking code.

Attack Vector

Exploitation requires the ability to configure or use a netem qdisc with a reorder probability on a local interface. Configuring netem typically requires CAP_NET_ADMIN, but containers or network namespaces granting that capability expand the attack surface. Once configured, a user space process generating sustained traffic through the qdisc can push the combined queue size well beyond sch->limit, consuming kernel memory and degrading networking performance.

No verified public exploit code is available. The vulnerability is described in the upstream kernel commits referenced below.

Detection Methods for CVE-2026-52984

Indicators of Compromise

Unexpected growth of sk_buff allocations attributed to qdisc queues on interfaces using netem
tc -s qdisc show dev <iface> reporting backlog values exceeding the configured limit parameter
Kernel memory pressure or OOM events on hosts running netem with reorder probability

Detection Strategies

Audit running kernel versions against the fixed commits listed in the Linux kernel stable tree
Enumerate active qdisc configurations across hosts and flag any netem instances using reorder parameters
Correlate spikes in slab cache memory (skbuff_head_cache) with traffic through netem-managed interfaces

Monitoring Recommendations

Track kernel slabinfo for skbuff allocations and alert on sustained anomalous growth
Monitor tc qdisc statistics for backlog values exceeding configured limits
Restrict and audit use of CAP_NET_ADMIN inside containers and unprivileged namespaces

How to Mitigate CVE-2026-52984

Immediate Actions Required

Apply the upstream kernel patch from the stable tree commit 0f875d52 or your distribution's backport
Inventory hosts using netem qdiscs with reorder probability and prioritize them for patching
Revoke CAP_NET_ADMIN from workloads that do not require traffic shaping or network namespace manipulation

Patch Information

The fix is committed across multiple stable kernel branches. Relevant commits include 0f875d52, 39a66e83, 4185701f, 54b5dbac, 74fcd8e1, 8450462e, 936a7dd8, and ef9a41b3. The patch modifies the limit comparison in netem_enqueue() to include sch->q.qlen alongside q->t_len.

Workarounds

Remove or disable netem qdiscs configured with non-zero reorder probability until patches are applied
Reduce the configured limit parameter on affected netem qdiscs to bound worst-case memory consumption
Use namespace and capability restrictions to prevent untrusted users from creating netem qdiscs

bash

# Remove a netem qdisc using reorder on a given interface
sudo tc qdisc del dev eth0 root

# Inspect current qdisc backlog and limit values
tc -s qdisc show dev eth0