CVE-2026-23437
Received Received - Intake
Use-After-Free Vulnerability in Linux Kernel netdev Hierarchy Access

Publication date: 2026-04-03

Last updated on: 2026-04-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is not proper, a conversion from a ref to a locked netdev must include a liveness check (a check if the netdev hasn't been unregistered already). Fix the read cases (those under RCU). Writes needs a separate change to protect from creating the hierarchy after flush has already run.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-03
Last Modified
2026-04-27
Generated
2026-06-16
AI Q&A
2026-04-03
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23437
EUVD
EUVD-2026-18678
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.13
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.19 (inc) to 6.19.10 (exc)
linux linux_kernel From 6.13.1 (inc) to 6.18.20 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's network subsystem, specifically in the net shaper component. The issue arises because when preparing Netlink operations, a network device (netdev) reference is taken without properly verifying if the device is still active (liveness check). Later, when locking or using Read-Copy-Update (RCU) mechanisms to protect access, the code assumes the netdev is still valid, which may not be true if the device has been unregistered. This improper handling can lead to unsafe late read accesses to the network hierarchy.

Impact Analysis

This vulnerability can lead to unsafe access to network device data structures after they have been unregistered, potentially causing system instability, crashes, or undefined behavior in the Linux kernel's networking stack. Such issues could affect the reliability and security of network operations on affected systems.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23437. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart