CVE-2026-52997

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()

Fix dualpi2_change() to correctly enforce updated limit and memlimit

values after a configuration change of the dualpi2 qdisc.

Before this patch, dualpi2_change() always attempted to dequeue packets

via the root qdisc (C-queue) when reducing backlog or memory usage, and

unconditionally assumed that a valid skb will be returned. When traffic

classification results in packets being queued in the L-queue while the

C-queue is empty, this leads to a NULL skb dereference during limit or

memlimit enforcement.

This is fixed by first dequeuing from the C-queue path if it is

non-empty. Once the C-queue is empty, packets are dequeued directly from

the L-queue. Return values from qdisc_dequeue_internal() are checked for

both queues. When dequeuing from the L-queue, the parent qdisc qlen and

backlog counters are updated explicitly to keep overall qdisc s

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References