CVE-2026-64054
Received Received - Intake

Linux Kernel Net Shaper Duplicate Leaves Group Request Vulnerability

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in old_nodes[]. The cleanup loop double frees the parent. Of course the same parent may still be in old_nodes[] twice if we are moving multiple of its leaves. Note that this patch also implicitly fixes the fact that the i >= leaves_count path forgets to set ret.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64054
EUVD
EUVD-2026-45627

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the network traffic shaper component. When userspace sends a GROUP request with duplicate leaf handles, the system fails to deduplicate entries. This causes the same parent pointer to be added twice to an array, leading to a double-free error during cleanup. Additionally, an off-by-one error exists where a cleanup loop skips setting a return value.

Detection Guidance

This vulnerability is specific to the Linux kernel's network shaper subsystem and requires kernel-level access to detect. There are no direct network commands to detect it. Check kernel logs for crashes or errors related to net_shaper_nl_group_doit() or duplicate leaf entries. Use 'dmesg | grep shaper' or 'journalctl -k | grep shaper' to review kernel messages.

Impact Analysis

This vulnerability could allow local users with appropriate privileges to cause a denial-of-service by crashing the system. The double-free error may lead to kernel memory corruption, potentially enabling further exploits or system instability.

Compliance Impact

This vulnerability is a Linux kernel issue related to network traffic shaping and does not directly impact compliance with standards like GDPR or HIPAA. It involves memory corruption due to improper handling of duplicate entries in a network shaper group request, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Avoid using the network shaper subsystem until patched. Monitor kernel updates from your distribution vendor and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64054. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart