The Linux kernel’s network emulator, netem, incorrectly re‑enqueues duplicated packets at the root queuing discipline. When a duplicate is performed, the copy can be re‑duplicated by additional netem instances in the queuing tree, leading to uncontrolled recursion until the kernel stack or memory is exhausted. The flaw originates from a guard that is per‑qdisc and shared across concurrent enqueue paths, which is unsafe without additional synchronization. The mitigation uses the skb tc_depth field to prevent duplication for packets that have already been duplicated, ensuring that the packet itself carries the duplication flag rather than modifying shared queuing discipline state. This vulnerability can cause a resource depletion condition that potentially crashes the networking stack or the entire system.

The issue affects all Linux kernel implementations that include the netem component, regardless of distribution. No specific kernel release is singled out, but the defect exists in the current netem implementation and was corrected in a recent patch.

The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog, indicating a low probability of exploitation in the wild. The CVSS score of 5.5 classifies it as medium severity. An attacker could trigger the loop by forcing traffic through a netem duplicate qdisc, consuming kernel resources. The attack surface is limited to systems where netem is actively configured, and the vulnerability requires kernel-level access to the queuing discipline state.