Answer in brief
CVE-2026-63983 records a Unknown severity vulnerability in net/sched: fix packet loop on netem when duplicate is on. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=0afb51e72855971dba83b3c6b70c547c2d1161fd <1a298a514ce766c6d0c232991a390fec67af81ad || >=0afb51e72855971dba83b3c6b70c547c2d1161fd <4ec3a8ca97394f17e73a4d8d4c79c1c78b322772 || >=0afb51e72855971dba83b3c6b70c547c2d1161fd <cfb2616042767ab31260d4f39190c381bec8b12e || >=0afb51e72855971dba83b3c6b70c547c2d1161fd <9552b11e3edabc97cfcd9f29103d5afbce7ae183 | 1a298a514ce766c6d0c232991a390fec67af81ad, 4ec3a8ca97394f17e73a4d8d4c79c1c78b322772, cfb2616042767ab31260d4f39190c381bec8b12e, 9552b11e3edabc97cfcd9f29103d5afbce7ae183 |
| Linux/Linuxgeneric | 2.6.12 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 15, 2026
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted. The original duplication guard temporarily zeroed q->duplicate around the re-enqueue, but that does not cover all cases because it is per-qdisc state shared across all concurrent enqueue paths and is not safe without additional locking. Use the skb tc_depth field introduced in an earlier patch: - increment it on the duplicate before re-enqueue - skip duplication for any skb whose tc_depth is already non-zero. This marks the packet itself rather than mutating qdisc state, therefore it is safe regardless of tree topology or concurrency.
Quoted source text, attributed separately from HOL analysis.