CVE-2026-63983: Linux Kernel Netem DoS Vulnerability

CVE-2026-63983 Overview

CVE-2026-63983 is a Linux kernel vulnerability in the net/sched subsystem affecting the netem (Network Emulator) queueing discipline. When netem duplicates a packet, it re-enqueues the copy at the root qdisc. If another netem instance sits in the qdisc tree, the copy can be duplicated again, recursing until the kernel stack or system memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but this per-qdisc state is shared across all concurrent enqueue paths and is unsafe without additional locking. Successful triggering results in a denial-of-service condition on the affected host.

Critical Impact
Recursive packet duplication in nested netem qdisc trees can exhaust kernel stack or memory, causing denial of service on affected Linux systems.

Affected Products

Linux kernel versions prior to the fixing commits in the net/sched subsystem
Systems using netem qdisc with the duplicate option enabled
Multi-tenant or traffic-shaping hosts with nested qdisc trees

Discovery Timeline

2026-07-19 - CVE-2026-63983 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63983

Vulnerability Analysis

The vulnerability resides in the Linux kernel traffic control (tc) subsystem, specifically in the netem queueing discipline. netem is used to emulate network conditions such as delay, loss, corruption, and packet duplication for testing purposes. When the duplicate option is active, netem creates a copy of an incoming packet and re-enqueues that copy at the root of the qdisc tree.

When the qdisc tree contains more than one netem instance, the duplicated packet can traverse another netem node and be duplicated again. Each recursive duplication consumes additional kernel stack frames and memory allocations. Unbounded recursion continues until the stack overflows or memory is exhausted, crashing the kernel or the network path.

The fix uses the skb tc_depth field introduced in an earlier patch. The kernel increments tc_depth on the duplicate before re-enqueue and skips duplication for any skb whose tc_depth is already non-zero. This marks the packet itself rather than mutating shared qdisc state.

Root Cause

The root cause is a design flaw in the original duplication guard. The prior mitigation temporarily zeroed the q->duplicate field around the re-enqueue call. Because this field is per-qdisc state shared across all concurrent enqueue paths, the guard was not race-safe and did not cover nested-qdisc scenarios. This constitutes an uncontrolled recursion leading to resource exhaustion.

Attack Vector

A local user with CAP_NET_ADMIN, or an automated configuration tool, can construct a qdisc hierarchy that chains multiple netem instances with duplicate enabled. Traffic traversing this hierarchy triggers recursive duplication. The condition can also arise unintentionally in complex traffic-shaping configurations, producing a denial-of-service without deliberate exploitation.

Refer to the Linux Kernel Commit Overview for the upstream fix. See also the additional stable branch commit and the related backport commit.

Detection Methods for CVE-2026-63983

Indicators of Compromise

Kernel panic or soft lockup messages referencing netem_enqueue or qdisc_enqueue in dmesg output
Sudden spikes in kernel memory consumption correlated with traffic through netem-managed interfaces
Unexplained network interface stalls on hosts running multiple netem qdiscs with the duplicate option

Detection Strategies

Audit qdisc configurations with tc qdisc show and identify nested netem instances that specify duplicate values greater than zero
Monitor kernel logs for stack overflow warnings, BUG: entries, or repeated netem warnings
Track kernel version inventory against the fixed commits 1a298a51, 9552b11e, and cfb26160

Monitoring Recommendations

Alert on kernel oops or panic events from telemetry agents ingesting /var/log/kern.log or journal entries
Continuously baseline kernel slab and stack usage on traffic-shaping hosts
Detect configuration changes to tc qdiscs through auditd rules on the tc binary and netlink traffic

How to Mitigate CVE-2026-63983

Immediate Actions Required

Update the Linux kernel to a version that includes commits 1a298a514ce7, 9552b11e3eda, or cfb2616042767
Inventory all hosts running netem qdiscs and validate configurations for nested duplicate usage
Restrict CAP_NET_ADMIN to trusted administrators and automation accounts

Patch Information

The upstream fix increments the skb->tc_depth field on the duplicated packet before re-enqueue and skips further duplication when tc_depth is already non-zero. This per-packet marker replaces the earlier per-qdisc guard and is safe under concurrency. Apply the fix through the vendor kernel package or by rebasing to a stable branch that includes the referenced commits.

Workarounds

Remove the duplicate option from all netem qdisc configurations until the kernel is patched
Avoid nesting multiple netem qdiscs in the same qdisc tree
Limit non-administrative access to network configuration utilities and namespaces that permit tc operations

bash

# Configuration example: remove duplicate from netem and verify
tc qdisc replace dev eth0 root netem delay 100ms loss 1%
tc qdisc show dev eth0

# Audit all interfaces for netem duplicate settings
for iface in $(ls /sys/class/net); do
    tc qdisc show dev "$iface" | grep -E 'netem.*duplicate' && echo "Review: $iface"
done