CVE-2026-23437

Description

In the Linux kernel's net: shaper subsystem, a race condition exists during Netlink operations. The subsystem looks up a netdev and increases its reference count in a pre-callback (prep) phase. Later, in the actual callback body, it uses RCU or a lock to access the netdev. However, there is no liveness check when converting from a reference to a locked or RCU-protected pointer. This means the netdev could have been unregistered between the lookup and the protected access, leading to a use-after-free condition [1].

Exploitation

An attacker must be able to trigger Netlink operations involving the net: shaper hierarchy. The vulnerability is triggered when a netdev is unregistered while a concurrent Netlink operation holds a stale reference. No special privileges beyond the ability to send Netlink messages are required, but the exploitation window depends on precise timing. The fix addresses read cases under RCU; writes require a separate change to prevent hierarchy creation after a flush has already run [2].

Impact

A successful exploit could allow an attacker with access to Netlink operations to cause a use-after-free of the netdev structure. This can lead to arbitrary memory corruption, potentially resulting in a system crash (denial of service) or privilege escalation in some kernel configurations. The CVSS v3 score is 7.8 (High), reflecting the high potential impact on confidentiality, integrity, and availability [3].

Mitigation

The vulnerability is fixed in Linux kernel stable commits. The fix adds a liveness check when converting from a reference to a locked/RCU-protected netdev. System administrators should apply the latest kernel updates from their distribution. No workarounds are documented, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of publication.