CVE-2026-53079: Linux Kernel DOS Vulnerability

CVE-2026-53079 Overview

CVE-2026-53079 is a memory leak vulnerability in the Linux kernel's network scheduler (net_sched) subsystem. The flaw occurs in the deferred queueing discipline (qdisc) drop path. When qdisc_run_end() cleans up the deferred list, it operates on the root qdisc. If the root qdisc does not implement the TCQ_F_DEQUEUE_DROPS flag, queued packets are never freed and remain stranded on the child qdisc's local to_free list. The result is a progressive leak of socket buffer (skb) memory during normal network traffic shaping operations.

Critical Impact
Sustained network traffic through affected qdisc configurations causes kernel memory exhaustion, potentially leading to denial of service on Linux systems.

Affected Products

Linux kernel versions containing the deferred qdisc drop optimization prior to the fix
Systems using traffic control (tc) with non-TCQ_F_DEQUEUE_DROPS root qdiscs
Distributions shipping vulnerable upstream kernels

Discovery Timeline

2026-06-24 - CVE-2026-53079 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53079

Vulnerability Analysis

The Linux kernel network scheduler uses a deferred drop mechanism to batch packet release operations during qdisc execution. The function qdisc_run_end() processes the deferred to_free list when scheduling completes. The optimization assumed that all qdiscs participating in the path implement the TCQ_F_DEQUEUE_DROPS flag, which signals support for processing batched drops at the root qdisc level.

When a child qdisc enqueues packets onto its local to_free list but the parent root qdisc lacks the TCQ_F_DEQUEUE_DROPS capability, the cleanup logic skips those packets. The packets remain referenced on the child structure indefinitely. Each leaked skb consumes kernel memory that never returns to the slab allocator.

Root Cause

The root cause is an incorrect assumption in qdisc_dequeue_drop() about which qdisc owns the to_free list cleanup. The optimization shifted responsibility to the root qdisc without verifying its feature flags. Child qdiscs continue to populate their local to_free lists, but no consumer processes them when the root qdisc does not advertise TCQ_F_DEQUEUE_DROPS.

The fix makes qdisc_dequeue_drop() aware of the root qdisc. It fetches the root qdisc and checks for the TCQ_F_DEQUEUE_DROPS flag. When the flag is present, the packet is appended directly to the root's to_free list. Otherwise, the packet is dropped inline as it was before the optimization existed.

Attack Vector

The vulnerability is triggered through normal network traffic that exercises qdisc drop paths, such as policing, rate limiting, or queue overflow conditions. A local user with the ability to configure traffic control rules, or sustained external traffic against a vulnerable qdisc hierarchy, can drive continuous skb allocations that never free. Over time, this depletes kernel memory and degrades system stability. Technical details are available in the kernel commit a6bd339dbb35 and the companion patch bf26ad92ffda.

Detection Methods for CVE-2026-53079

Indicators of Compromise

Growing kmalloc slab usage attributable to skbuff_head_cache without corresponding traffic increases
Steady decrease in MemAvailable reported in /proc/meminfo on systems running traffic shaping
dmesg warnings or out-of-memory events on hosts using non-TCQ_F_DEQUEUE_DROPS root qdiscs

Detection Strategies

Inspect /proc/slabinfo for unbounded growth in skbuff_head_cache and related caches over time
Audit running qdisc configurations with tc qdisc show to identify root qdiscs lacking the dequeue-drops capability
Correlate kernel version against the fix commits to determine exposure on each host

Monitoring Recommendations

Track kernel slab memory metrics through node-exporter or equivalent telemetry pipelines
Alert on sustained skb cache growth that does not correlate with traffic volume
Monitor dmesg for qdisc-related warnings and OOM-killer activity on network-intensive systems

How to Mitigate CVE-2026-53079

Immediate Actions Required

Identify hosts running kernels with the deferred qdisc drop optimization but without the fix commits applied
Apply the upstream stable kernel patches referenced in the kernel git tree
Where patching is delayed, review traffic control configurations and replace non-TCQ_F_DEQUEUE_DROPS root qdiscs where feasible

Patch Information

The fix is applied in the upstream Linux kernel via commits a6bd339dbb35 and bf26ad92ffda. Update to a kernel release that includes these commits, or apply the backport provided by your Linux distribution.

Workarounds

Use root qdiscs that implement the TCQ_F_DEQUEUE_DROPS flag where possible
Schedule periodic reboots on long-running network nodes to reclaim leaked memory until patching completes
Reduce traffic load on affected qdisc paths to slow the leak rate prior to remediation

bash

# Inspect current qdisc configuration on each interface
tc qdisc show

# Check skb-related slab memory growth
grep skbuff /proc/slabinfo

# Verify running kernel version against fix commits
uname -r