{"cve":"CVE-2026-63983","nvd":{"published":"2026-07-19T16:17:17.490","modified":"2026-10-15T11:17:38.033","status":"Undergoing Analysis","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: fix packet loop on netem when duplicate is on\n\nWhen netem duplicates a packet it re-enqueues the copy at the root qdisc.\nIf another netem sits in the tree the copy can be duplicated\nagain, recursing until the stack or memory is exhausted.\n\nThe original duplication guard temporarily zeroed q->duplicate around\nthe re-enqueue, but that does not cover all cases because it is\nper-qdisc state shared across all concurrent enqueue paths\nand is not safe without additional locking.\n\nUse the skb tc_depth field introduced in an earlier patch:\n - increment it on the duplicate before re-enqueue\n - skip duplication for any skb whose tc_depth is already non-zero.\n\nThis marks the packet itself rather than mutating qdisc state,\ntherefore it is safe regardless of tree topology or concurrency.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/1a298a514ce766c6d0c232991a390fec67af81ad","https://git.kernel.org/stable/c/4ec3a8ca97394f17e73a4d8d4c79c1c78b322772","https://git.kernel.org/stable/c/9552b11e3edabc97cfcd9f29103d5afbce7ae183","https://git.kernel.org/stable/c/cfb2616042767ab31260d4f39190c381bec8b12e"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:45:36.895656543+00:00"},"epss":{"cve":"CVE-2026-63983","score":0.00168,"percentile":0.06025,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}