Medium 5.5Published Jun 24, 2026

CVE-2026-52984net/sched: netem: fix queue limit check to include reordered packets

Updated under an hour ago (Oct 29, 2026, 12:23 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: fix queue limit check to include reordered packets The queue limit check in netem_enqueue() uses q->t_len which only counts packets in the internal tfifo. Packets placed in sch->q by the reorder path (__qdisc_enqueue_head) are not counted, allowing the total queue occupancy to exceed sch->limit under reordering. Include sch->q.qlen in the limit check.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	216509dda290f6db92c816dd54b83c1df9da9e76 builds before 0f875d52db4c921da610e481b72f03cc82fdcb72; from c2047b0e216c8edce227d7c42f99ac2877dad0e4 before ef9a41b3870fb90577da5b2de5bd140022d4021e; from 10df49cfca73dfbbdb6c4150d859f7e8926ae427 before 74fcd8e127200a50ee22ba2b45c164722bdb9177; 3824c5fad18eeb7abe0c4fc966f29959552dca3e builds before 39a66e83ea41fe845631eeb8d326953de27d13f9; 356078a5c55ec8d2061fcc009fb8599f5b0527f9 builds before 54b5dbacd00dedffd5e2eed76de1c3839996b5e6; from f8d4bc455047cf3903cd6f85f49978987dbb3027 before 8450462eaf91d5d2a9e863507b16d18e814baef3; from f8d4bc455047cf3903cd6f85f49978987dbb3027 before 936a7dd87251f6f3e88983350833edf60fe6a80b; from f8d4bc455047cf3903cd6f85f49978987dbb3027 before 4185701fcce6b426b6c3630b25330dddd9c47b0d; and 7 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.4.288 before 5.5; from 5.10.232 before 5.10.258; from 5.15.175 before 5.15.209; from 6.1.121 before 6.1.175; from 6.6.67 before 6.6.141; from 6.12.6 before 6.12.91; from 6.13.1 before 6.18.33; from 6.19 before 7.0.10; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0f875d52db4c921da610e481b72f03cc82fdcb72	patch
https://git.kernel.org/stable/c/ef9a41b3870fb90577da5b2de5bd140022d4021e	patch
https://git.kernel.org/stable/c/74fcd8e127200a50ee22ba2b45c164722bdb9177	patch
https://git.kernel.org/stable/c/39a66e83ea41fe845631eeb8d326953de27d13f9	patch
https://git.kernel.org/stable/c/54b5dbacd00dedffd5e2eed76de1c3839996b5e6	patch
https://git.kernel.org/stable/c/8450462eaf91d5d2a9e863507b16d18e814baef3	patch
https://git.kernel.org/stable/c/936a7dd87251f6f3e88983350833edf60fe6a80b	patch
https://git.kernel.org/stable/c/4185701fcce6b426b6c3630b25330dddd9c47b0d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.