CVE-2026-64207

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the DualPI2 scheduler regarding GSO (Generic Segmentation Offload) backlog accounting. When DualPI2 splits a GSO skb into N segments, it propagates N additional packets to its parent before returning NET XMIT SUCCESS, causing the parent's qlen to be one larger than the actual number of queued packets. If QFQ is the parent, this discrepancy leads to a state where QFQ maintains a non-zero qlen despite having no active classes in its in-service aggregate. Consequently, the function qfq choose next agg() returns NULL, which is then passed to qfq peek skb() via qfq dequeue(), resulting in a NULL pointer dereference.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.