CVE-2026-64207: Linux Kernel DualPI2 DoS Vulnerability

CVE-2026-64207 Overview

CVE-2026-64207 is a Linux kernel vulnerability in the net/sched subsystem, specifically in the DualPI2 queueing discipline (qdisc). The flaw involves incorrect Generic Segmentation Offload (GSO) backlog accounting. When DualPI2 splits a GSO socket buffer (skb) into multiple segments, it propagates extra packet counts to its parent qdisc. The parent then double-counts the original skb, leaving its queue length (qlen) larger than the actual number of queued packets. When paired with the Quick Fair Queueing (QFQ) parent qdisc, this desynchronization triggers a NULL pointer dereference in qfq_peek_skb(), resulting in a kernel crash.

Critical Impact
A local unprivileged attacker with the ability to configure or trigger traffic through a DualPI2 qdisc parented to QFQ can cause a kernel NULL pointer dereference, leading to a denial-of-service condition.

Affected Products

Linux kernel versions that include the DualPI2 qdisc implementation in net/sched
Systems configuring DualPI2 as a child qdisc under QFQ
Distributions shipping the affected upstream kernel commits prior to the fix

Discovery Timeline

2026-07-20 - CVE-2026-64207 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64207

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] rooted in a queue accounting error inside the Linux traffic control (tc) subsystem. DualPI2 is a dual-queue Proportional Integral controller Improved with a square (PI2) qdisc used for low-latency, low-loss, scalable throughput (L4S) traffic management.

When DualPI2 receives a GSO skb, it splits the aggregated skb into N individual segments using segmentation offload teardown. It then enqueues each segment and reports N additional packets back to its parent qdisc through qdisc_tree_reduce_backlog(). However, the parent qdisc has already counted the original GSO skb once. The result is that the parent's qlen becomes inflated by one packet beyond what is actually queued.

With QFQ configured as the parent qdisc, this mismatch manifests during dequeue. After all real packets drain, QFQ still believes one packet remains queued. The scheduler calls qfq_dequeue(), which invokes qfq_choose_next_agg(). That function returns NULL because the in-service aggregate has no active classes. The NULL result is passed to qfq_peek_skb(), which dereferences the pointer and triggers a kernel oops.

Root Cause

The root cause is inconsistent packet accounting between DualPI2 and its parent qdisc during GSO segmentation. DualPI2 did not follow the established pattern used by tbf_segment() and taprio, which count only successfully queued segments and propagate the difference between the original skb count and the actual queued segment count. Without this reconciliation, qlen diverges from the true queue state.

Attack Vector

Exploitation requires the ability to configure a tc qdisc hierarchy with DualPI2 as a child of QFQ, or to send traffic through a system where such a configuration exists. On systems where unprivileged users cannot configure qdiscs, this is primarily a stability and denial-of-service concern triggered by GSO traffic patterns. On systems in network namespaces where users hold CAP_NET_ADMIN, a local attacker could deliberately construct the vulnerable hierarchy and generate GSO traffic to crash the host.

The patch modifies DualPI2 segmentation logic to count only successfully queued segments, propagate the correct backlog difference to the parent, and return NET_XMIT_SUCCESS whenever at least one segment was queued. Technical details are available in the kernel commit c4b70c1512b8f9f33f23c2c8196dfd1210207681.

Detection Methods for CVE-2026-64207

Indicators of Compromise

Kernel oops or panic messages referencing qfq_peek_skb, qfq_dequeue, or qfq_choose_next_agg in dmesg or /var/log/kern.log
Unexpected NULL pointer dereference stack traces originating in net/sched/sch_qfq.c
System crashes correlated with active tc configurations using DualPI2 parented to QFQ

Detection Strategies

Audit running tc qdisc show output across production hosts to identify DualPI2 qdiscs configured under QFQ parents
Monitor kernel ring buffer for NULL pointer dereference traces involving the QFQ scheduler code path
Correlate kernel crash reports with GSO-heavy workloads on affected qdisc hierarchies

Monitoring Recommendations

Ingest kernel logs into a centralized logging or SIEM platform and alert on oops signatures containing qfq_ symbol names
Track qdisc qlen statistics via tc -s qdisc to detect drift between reported and actual queue depth
Enable kdump or equivalent crash capture to preserve forensic evidence for post-incident analysis

How to Mitigate CVE-2026-64207

Immediate Actions Required

Apply the upstream kernel patches referenced in the fix commits as soon as your distribution publishes updated packages
Inventory all systems using DualPI2 (sch_dualpi2) as a child qdisc of QFQ (sch_qfq) and prioritize them for patching
Reboot patched systems to load the corrected kernel, since qdisc code paths execute in kernel context

Patch Information

The fix is available in the following upstream kernel commits: 05ed733b65ab977dd931e7f7ac0f62fdb81205c2, 806586e33891066487db1f002be3d455cda6b516, and c4b70c1512b8f9f33f23c2c8196dfd1210207681. Consult your Linux distribution vendor for backported stable kernel updates.

Workarounds

Reconfigure affected qdisc hierarchies to avoid parenting DualPI2 under QFQ until patches are applied
Substitute an alternative parent qdisc such as HTB or use DualPI2 as a root qdisc where the topology permits
Restrict CAP_NET_ADMIN in untrusted network namespaces and containers to prevent local users from constructing the vulnerable configuration

bash

# Identify systems running DualPI2 under QFQ
tc qdisc show | grep -E 'dualpi2|qfq'

# Remove a vulnerable DualPI2 qdisc (replace <dev> and <handle>)
tc qdisc del dev <dev> parent <qfq_handle> handle <dualpi2_handle> dualpi2

# Verify current kernel version after patching
uname -r