The Linux kernel vulnerability CVE-2026-64207 concerns the DualPI2 queuing discipline in the net/sched subsystem. When DualPI2 splits a GSO skb into N segments, it incorrectly propagates N additional packets to its parent queuing discipline before returning success. The parent then double-counts the original skb, causing its queue length to be larger than the actual number of packets queued. When QFQ is the parent, this leads to a non-zero queue length despite no active classes, causing qfq_choose_next_agg() to return NULL and qfq_dequeue() to dereference a NULL pointer, resulting in a kernel crash. The fix aligns DualPI2's accounting with other subsystems by counting only successfully queued segments and returning success if at least one segment was queued.

This vulnerability can cause a denial of service by triggering a NULL pointer dereference in the Linux kernel's network scheduler, leading to kernel crashes and system instability. It does not affect confidentiality or integrity but impacts system availability. There are no known exploits in the wild according to the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the vulnerability has been resolved in the Linux kernel, but no explicit patch links or fixed versions are provided. Users should monitor official Linux kernel security advisories and update to the fixed kernel versions once available.