CVE-2026-63983

A flaw was found in the Linux kernel's network emulator (netem) component. This vulnerability occurs when netem duplicates a packet and re-enqueues it, leading to a recursive packet duplication loop if multiple netem instances are configured. This uncontrolled recursion can exhaust system resources, such as memory or stack, resulting in a Denial of Service (DoS) for the affected system.

This vulnerability is rated as Moderate because exploitation requires local administrative privileges (CAP_NET_ADMIN) to configure traffic control queuing disciplines, restricting the impact to a denial of service. In typical Red Hat Enterprise Linux installations, the network emulation scheduler is not deployed in production, limiting attack exposure to environments that explicitly configure traffic simulation. Although configurations permitting unprivileged user namespaces could allow local users to establish nested qdisc hierarchies, the issue cannot be triggered remotely and does not lead to privilege escalation or information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.