CVE-2026-52997: Linux Kernel dualpi2 Qdisc NULL Pointer DoS Vulnerability

Technical summary

CVE-2026-52997 is a NULL pointer dereference in the net/sched subsystem's dualpi2 qdisc implementation. The dualpi2_change() function attempts to enforce updated limit and memlimit values by dequeuing packets exclusively through the C-queue (root qdisc) path. However, when traffic classification places packets in the L-queue while the C-queue remains empty, the function unconditionally dereferences the returned skb without validating it, triggering a NULL pointer dereference. The fix implements a fallback dequeue path: first attempting the C-queue, then directly dequeuing from the L-queue with proper NULL checks and explicit updates to parent qdisc statistics (qlen and backlog counters) to maintain consistency.

Business impact

This vulnerability presents a localized denial-of-service risk to Linux deployments relying on dualpi2 qdisc for quality-of-service or traffic management. An unprivileged local attacker can crash the kernel by modifying dualpi2 qdisc configuration while traffic patterns favor the L-queue, disrupting network services and potentially triggering unexpected system downtime. Organizations operating containerized or multi-tenant environments, or those using advanced traffic shaping for network isolation, are at elevated risk.

Affected systems

The Linux kernel is affected. Exposure is specific to systems with dualpi2 qdisc configured and in active use. This is not a default qdisc and is typically deployed in specialized networking environments, such as ISP backbone equipment, data center traffic management, or advanced QoS setups. Kernel versions prior to the fix are affected; verify the exact patched versions against the Linux kernel security advisories.

Exploitability

Exploitation requires local access and the ability to modify qdisc configuration (typically CAP_NET_ADMIN privileges). The attack surface is narrow compared to remote vulnerabilities, but the trigger is straightforward: reconfiguring dualpi2 limits or memlimits while traffic patterns direct packets to the L-queue. No user interaction or race conditions are necessary. The CVSS vector (AV:L/AC:L/PR:L) reflects this local, low-complexity profile.

Remediation

Apply a kernel update that includes the dualpi2_change() fix. The patch ensures both C-queue and L-queue are properly drained during configuration updates, with correct NULL pointer handling and qdisc statistic synchronization. Verify the exact patch version from your Linux distribution's security advisory, as kernel versions and patch timing vary by distribution.

Patch guidance

Update the Linux kernel to a version that includes the fix for dualpi2_change(). Check your distribution's security channel (e.g., Ubuntu Security Notices, Red Hat Security Advisories, SUSE Security Updates, Debian Security Tracker) for the specific kernel version containing this patch. If dualpi2 is not used in your environment, the risk is eliminated; however, applying the kernel update is still recommended for overall security posture. Test the update in a non-production environment first, particularly if custom qdisc configurations are in place.

Detection guidance

Monitor kernel logs and syslog for NULL pointer dereference errors in the dualpi2 module. Kernel Oops messages referencing dualpi2_change() or the net/sched subsystem may indicate exploitation attempts. Additionally, monitor for unexpected kernel crashes following qdisc configuration changes on systems running dualpi2. If dualpi2 is deployed, correlate qdisc reconfigurations with system stability events. Intrusion detection systems should flag repeated attempts to modify dualpi2 qdisc parameters from unprivileged processes.

Why prioritize this

Although CVE-2026-52997 is rated MEDIUM (5.5 CVSS), it should be prioritized for organizations actively deploying dualpi2 qdisc. The vulnerability is triggered by a common operational task—updating traffic management policies—making it more likely to be encountered in production. The denial-of-service impact can be severe in latency-sensitive or availability-critical networks. Conversely, organizations without dualpi2 in use can defer this patch below critical Linux kernel updates affecting broader attack surfaces.

Risk score, explained

CVSS 5.5 (MEDIUM) reflects a local-only attack vector, low complexity, and denial-of-service impact without confidentiality or integrity compromise. The relatively low score should not minimize operational risk for dualpi2 users: a kernel crash disrupts service, and the ease of triggering (reconfiguring limits) makes this a practical threat in managed networking environments. Context matters—organizations with dualpi2 deployed should treat this as higher priority than the base score alone suggests.

Frequently asked questions