CVE-2026-64054 Overview
CVE-2026-64054 is a Linux kernel vulnerability in the network shaper subsystem. The flaw resides in net_shaper_nl_group_doit(), which fails to deduplicate NET_SHAPER_A_LEAVES entries supplied through a Netlink GROUP request. When userspace submits the same leaf handle twice, the same old-parent pointer is stored twice in old_nodes[]. The cleanup loop then frees the same parent object more than once, producing a double free condition [CWE-415]. The patch also corrects a related bug on the i >= leaves_count path where the return value was not set.
Critical Impact
A local user able to issue net shaper Netlink commands can trigger a kernel double free, leading to memory corruption, denial of service, or potential privilege escalation.
Affected Products
- Linux kernel versions containing the net/shaper subsystem prior to the fix
- Distributions shipping kernels with net_shaper_nl_group_doit() implementation
- Stable kernel branches referenced in the upstream commits
Discovery Timeline
- 2026-07-19 - CVE-2026-64054 published to NVD
- 2026-07-19 - Last updated in NVD database
Technical Details for CVE-2026-64054
Vulnerability Analysis
The Linux kernel network shaper subsystem provides a Netlink interface for grouping traffic-shaping leaves under a common parent node. The GROUP operation is handled by net_shaper_nl_group_doit(), which iterates the NET_SHAPER_A_LEAVES attribute list supplied by the caller. For each leaf, the routine records the current parent in an old_nodes[] array so that unused parents can be released after the reparenting completes.
The handler performs no deduplication of the leaf handles. A userspace caller can therefore include the same leaf handle twice in a single GROUP request. Both iterations resolve to the same parent, so the identical pointer is written to old_nodes[] in two slots. The subsequent cleanup loop walks old_nodes[] and frees each entry, releasing the same parent object twice. The same defect also manifests when several distinct leaves share one parent and all of them are moved in a single call.
A secondary issue exists on the i >= leaves_count error path, which returned without assigning the ret variable and could leak an uninitialized status back to the caller.
Root Cause
The root cause is missing input validation in net_shaper_nl_group_doit(). The function trusts the leaf list from userspace and does not detect duplicate handles or duplicate old-parent pointers before adding them to old_nodes[], resulting in a double free [CWE-415] during cleanup.
Attack Vector
Exploitation requires local access with the ability to send Netlink messages to the net shaper family. A crafted GROUP request that references the same leaf handle multiple times triggers the double free inside the kernel, corrupting the slab allocator state. The upstream commits 31767bf852b5, 5098b223f0f0, and a9a2fa1da619 add deduplication logic and fix the missing return value assignment. Refer to the Kernel Git Commit Log for the authoritative patch content.
Detection Methods for CVE-2026-64054
Indicators of Compromise
- Kernel slab-use-after-free or double-free splats referencing net_shaper_nl_group_doit or net/shaper/shaper.c in dmesg
- Unexpected kernel oops or panic traces originating from Netlink GROUP handling in the shaper family
- KASAN reports flagging repeated frees of the same net_shaper parent object
Detection Strategies
- Enable KASAN on test kernels to catch double-free conditions during fuzzing of the net shaper Netlink interface
- Audit process telemetry for unprivileged workloads issuing AF_NETLINK traffic to the generic Netlink net_shaper family
- Correlate kernel crash artifacts with the process that issued the preceding Netlink GROUP request
Monitoring Recommendations
- Collect and centralize kernel.* syslog facility messages to surface panics and KASAN reports
- Monitor /proc/vmcore and kdump artifacts for crash signatures in shaper code paths
- Track kernel version inventory across Linux fleets to identify hosts still running vulnerable builds
How to Mitigate CVE-2026-64054
Immediate Actions Required
- Apply the upstream stable kernel updates that include commits 31767bf852b5, 5098b223f0f0, and a9a2fa1da619
- Restrict access to the net shaper Netlink interface to trusted administrative users and workloads only
- Rebuild and redeploy custom kernels that carry the net/shaper subsystem to include the fix
Patch Information
The fix is delivered through three upstream commits published in the stable tree. The relevant references are the Kernel Git Commit 31767bf852b5, the Kernel Git Commit 5098b223f0f0, and the Kernel Git Commit a9a2fa1da619. Distribution maintainers should backport these patches to any supported kernel branch that ships the net shaper subsystem.
Workarounds
- Disable or unload the net shaper functionality on systems that do not require traffic shaping via this interface
- Use Linux capabilities and seccomp policies to prevent untrusted processes from opening generic Netlink sockets that reach the shaper family
- Deploy mandatory access control policies (SELinux, AppArmor) that constrain which workloads can invoke shaper administrative operations
# Verify running kernel version and inspect for the fix
uname -r
# Confirm the patched commits are present in the source tree
git log --oneline | grep -E "31767bf852b5|5098b223f0f0|a9a2fa1da619"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
