{"api_version":"1","generated_at":"2026-07-22T18:47:02+00:00","cve":"CVE-2026-63983","urls":{"html":"https://cve.report/CVE-2026-63983","api":"https://cve.report/api/cve/CVE-2026-63983.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-63983","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-63983"},"summary":{"title":"net/sched: fix packet loop on netem when duplicate is on","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q->duplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-07-19 16:17:17","updated_at":"2026-07-19 16:17:17"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad","name":"https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183","name":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e","name":"https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63983","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63983","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0afb51e72855971dba83b3c6b70c547c2d1161fd 1a298a514ce766c6d0c232991a390fec67af81ad git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0afb51e72855971dba83b3c6b70c547c2d1161fd cfb2616042767ab31260d4f39190c381bec8b12e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0afb51e72855971dba83b3c6b70c547c2d1161fd 9552b11e3edabc97cfcd9f29103d5afbce7ae183 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.12","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.93 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.0.12 7.0.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"63983","cve":"CVE-2026-63983","epss":"0.001660000","percentile":"0.061650000","score_date":"2026-07-20","updated_at":"2026-07-21 00:13:14"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"1a298a514ce766c6d0c232991a390fec67af81ad","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"cfb2616042767ab31260d4f39190c381bec8b12e","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"},{"lessThan":"9552b11e3edabc97cfcd9f29103d5afbce7ae183","status":"affected","version":"0afb51e72855971dba83b3c6b70c547c2d1161fd","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/sched/sch_netem.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.12"},{"lessThan":"2.6.12","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.93","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.12","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.93","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.0.12","versionStartIncluding":"2.6.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1","versionStartIncluding":"2.6.12","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q->duplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency."}],"providerMetadata":{"dateUpdated":"2026-07-19T14:56:06.047Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad"},{"url":"https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e"},{"url":"https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183"}],"title":"net/sched: fix packet loop on netem when duplicate is on","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-63983","datePublished":"2026-07-19T14:56:06.047Z","dateReserved":"2026-07-19T07:54:57.025Z","dateUpdated":"2026-07-19T14:56:06.047Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-07-19 16:17:17","lastModifiedDate":"2026-07-19 16:17:17","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"63983","Ordinal":"1","Title":"net/sched: fix packet loop on netem when duplicate is on","CVE":"CVE-2026-63983","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"63983","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q->duplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency.","Type":"Description","Title":"net/sched: fix packet loop on netem when duplicate is on"}]}}}