CVE-2026-52997 Overview
CVE-2026-52997 is a Linux kernel vulnerability in the net/sched subsystem, specifically within the sch_dualpi2 queueing discipline. The flaw resides in the dualpi2_change() function, which fails to correctly drain both the Classic queue (C-queue) and Low-latency queue (L-queue) when configuration changes occur. When traffic classification places packets in the L-queue while the C-queue is empty, the function dereferences a NULL socket buffer (skb) pointer during limit or memlimit enforcement. The issue has been resolved in upstream kernel commits that ensure both queues are drained correctly and that return values from qdisc_dequeue_internal() are validated.
Critical Impact
A local user with CAP_NET_ADMIN privileges can trigger a NULL pointer dereference in the kernel by reconfiguring the dualpi2 qdisc, leading to a kernel crash and denial of service.
Affected Products
- Linux kernel versions containing the sch_dualpi2 queueing discipline
- Distributions shipping kernels prior to the fix commits 3042add80c2c, 478ed6b7d257, and 86cf2eba2056
- Systems using the dualpi2 qdisc for traffic classification and queue management
Discovery Timeline
- 2026-06-24 - CVE-2026-52997 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52997
Vulnerability Analysis
The vulnerability is a NULL pointer dereference [CWE-476] within the Linux kernel's traffic control subsystem. The dualpi2 qdisc implements a dual-queue Active Queue Management (AQM) scheme that maintains separate queues for classic and low-latency traffic. When an administrator updates qdisc parameters via tc qdisc change, the kernel invokes dualpi2_change() to enforce new limit and memlimit values by draining excess packets.
The original implementation always attempted to dequeue from the root qdisc path, which corresponds to the C-queue. The code assumed the dequeue call would always return a valid skb pointer. However, when all queued packets reside in the L-queue and the C-queue is empty, the dequeue returns NULL. The subsequent dereference of this NULL pointer triggers a kernel oops.
Root Cause
The root cause is an incorrect assumption about packet distribution across the dual queue structure. The dualpi2_change() function did not check whether qdisc_dequeue_internal() returned a valid skb before operating on it. Additionally, the function did not consider that packets could exist exclusively in the L-queue, leaving the C-queue empty even when the overall qdisc backlog exceeded the new limit.
Attack Vector
Exploitation requires local access with network administration privileges (CAP_NET_ADMIN). An attacker with these privileges configures a dualpi2 qdisc, generates traffic that classifies into the L-queue, and then issues a tc qdisc change command that lowers the limit or memlimit below the current backlog. The kernel then triggers the NULL dereference during enforcement, causing a denial of service.
The vulnerability is described in the upstream patches without an accompanying public proof-of-concept. See the kernel commit 86cf2eba2056 for technical details of the fix.
Detection Methods for CVE-2026-52997
Indicators of Compromise
- Kernel oops or panic messages referencing dualpi2_change or sch_dualpi2 in dmesg or /var/log/kern.log
- NULL pointer dereference stack traces involving qdisc_dequeue_internal called from the dualpi2 module
- Unexpected network interface reset or traffic control reconfiguration events preceding a kernel fault
Detection Strategies
- Monitor kernel ring buffer output for crash signatures involving sch_dualpi2.ko and NULL pointer dereference faults
- Audit tc qdisc change operations against dualpi2 qdiscs using auditd rules on the tc binary or netlink socket activity
- Correlate CAP_NET_ADMIN privilege usage with subsequent network subsystem instability across the fleet
Monitoring Recommendations
- Enable kernel crash collection via kdump to capture full stack traces when dualpi2-related faults occur
- Track running kernel versions across the environment and flag hosts that have not received the fix commits
- Alert on repeated tc invocations against dualpi2 qdiscs followed by kernel log anomalies
How to Mitigate CVE-2026-52997
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in commits 3042add80c2c, 478ed6b7d257, and 86cf2eba2056 once vendor-backported builds are available
- Inventory systems using the sch_dualpi2 qdisc by running tc qdisc show across managed hosts
- Restrict CAP_NET_ADMIN to trusted administrators and remove the capability from unnecessary service accounts
Patch Information
The fix modifies dualpi2_change() to first drain packets from the C-queue path when it is non-empty, then dequeue directly from the L-queue when the C-queue is empty. Return values from qdisc_dequeue_internal() are validated for both queues. Parent qdisc qlen and backlog counters are updated explicitly when dequeuing from the L-queue to keep statistics consistent. Refer to kernel commit 3042add80c2c and kernel commit 478ed6b7d257 for the complete patches.
Workarounds
- Avoid configuring the sch_dualpi2 qdisc on production interfaces until patched kernels are deployed
- Replace dualpi2 with an alternative AQM such as fq_codel or cake where feasible
- Blacklist the sch_dualpi2 kernel module on systems that do not require it by adding it to /etc/modprobe.d/blacklist.conf
# Configuration example
# Identify interfaces using dualpi2
tc qdisc show | grep dualpi2
# Replace dualpi2 with fq_codel on a given interface
sudo tc qdisc replace dev eth0 root fq_codel
# Prevent the vulnerable module from loading
echo 'blacklist sch_dualpi2' | sudo tee /etc/modprobe.d/blacklist-dualpi2.conf
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
