CVE-2026-23436

Vulnerability

A race condition exists in the Linux kernel's net/shaper subsystem. During Netlink operations, a reference to a network device (netdev) is taken in the pre-callback, but the actual locking occurs later in the callback body. If the net/shaper: protect from late creation of hierarchy. If the netdev is unregistered between these two points, a hierarchy could be allocated after the flush operation has already completed, leading to a memory leak [1].

Exploitation

An attacker with the ability to trigger Netlink SET operations on a netdev that is being concurrently unregistered could exploit this race. The attack requires precise timing to cause the hierarchy allocation to occur after the flush. No special privileges beyond the ability to issue the relevant Netlink operations are mentioned in the description [1].

Impact

Successful exploitation results in a memory leak of the shaper hierarchy. This could lead to resource exhaustion over time, potentially causing denial of service. The CVSS v3 score of 5.5 (Medium) reflects the availability impact [1].

Mitigation

The fix moves the instance lock acquisition into the pre-callback, eliminating the race window and removing the need for separate lock/unlock callbacks. The patch has been applied to the stable kernel tree [1]. Users should update to a kernel version containing this commit.