CVE-2026-64207

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/sched: dualpi2: fix GSO backlog accounting<br /> <br /> When DualPI2 splits a GSO skb into N segments, it propagates N<br /> additional packets to its parent before returning NET_XMIT_SUCCESS.<br /> The parent then accounts for the original skb once more, leaving its<br /> qlen one larger than the number of packets actually queued.<br /> <br /> With QFQ as the parent, after all real packets are dequeued, QFQ still<br /> has a non-zero qlen while its in-service aggregate has no active<br /> classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes<br /> the result to qfq_peek_skb(), causing a NULL pointer dereference.<br /> <br /> Follow the same pattern used by tbf_segment() and taprio: count only<br /> successfully queued segments, propagate the difference between the<br /> original skb and those segments, and return NET_XMIT_SUCCESS whenever<br /> at least one segment was queued.