Use-After-Free Vulnerability in Linux Kernel netdev Hierarchy Access

Publication date: 2026-04-03

Last updated on: 2026-04-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is not proper, a conversion from a ref to a locked netdev must include a liveness check (a check if the netdev hasn't been unregistered already). Fix the read cases (those under RCU). Writes needs a separate change to protect from creating the hierarchy after flush has already run.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-03

Last Modified

2026-04-27

Generated

2026-07-06

AI Q&A

2026-04-03

EPSS Evaluated

2026-07-05

NVD

CVE-2026-23437

EUVD

EUVD-2026-18678

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.13
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	7.0
linux	linux_kernel	From 6.19 (inc) to 6.19.10 (exc)
linux	linux_kernel	From 6.13.1 (inc) to 6.18.20 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's network subsystem, specifically in the net shaper component. The issue arises because when preparing Netlink operations, a network device (netdev) reference is taken without properly verifying if the device is still active (liveness check). Later, when locking or using Read-Copy-Update (RCU) mechanisms to protect access, the code assumes the netdev is still valid, which may not be true if the device has been unregistered. This improper handling can lead to unsafe late read accesses to the network hierarchy.

Impact Analysis

This vulnerability can lead to unsafe access to network device data structures after they have been unregistered, potentially causing system instability, crashes, or undefined behavior in the Linux kernel's networking stack. Such issues could affect the reliability and security of network operations on affected systems.

Hi! I’m here to help you understand CVE-2026-23437. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70