CVE-2026-64054 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: shaper: reject duplicate leaves in GROUP request
net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in old_nodes[]. The cleanup loop double
frees the parent. Of course the same parent may still be in old_nodes[]
twice if we are moving multiple of its leaves.
Note that this patch also implicitly fixes the fact that the i >= leaves_count path forgets to set ret.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability resides within the Linux kernel's networking subsystem, specifically in the shaper module responsible for traffic control and bandwidth management. This issue affects the net_shaper_nl_group_doit() function which processes group requests through netlink sockets. The flaw manifests when userspace applications submit GROUP requests containing duplicate leaf handles within the NET_SHAPER_A_LEAVES attribute. The kernel fails to properly deduplicate these entries during processing, leading to a critical memory corruption scenario.
The technical implementation flaw occurs in how the kernel manages parent node references within the old_nodes[] array. When duplicate leaf handles are provided, identical parent pointers are stored multiple times in this array structure. During the cleanup phase of the function, the code iterates through these entries and attempts to free parent nodes. However, due to the duplication, the same parent memory location gets freed twice, creating a double-free vulnerability that can be exploited to corrupt kernel memory structures. This memory corruption represents a direct violation of memory safety principles and creates opportunities for privilege escalation.
The operational impact of this vulnerability extends beyond simple memory corruption, as it can potentially allow attackers with local access or those able to manipulate network traffic to execute arbitrary code within the kernel space. The double-free condition creates heap corruption that may be exploitable through carefully crafted payload delivery mechanisms. According to CWE classification, this represents a CWE-415: Double Free vulnerability, which is particularly dangerous in kernel contexts where memory corruption can lead to complete system compromise. The vulnerability also contains an additional logical error where the code path handling cases where i >= leaves_count fails to properly set the return value, potentially causing unpredictable behavior in the kernel's error handling mechanisms.
Mitigation strategies should focus on implementing proper input validation and deduplication logic within the net_shaper_nl_group_doit() function. The patch addresses this by ensuring that duplicate leaf handles are properly detected and removed before processing begins, preventing the accumulation of duplicate parent node references. System administrators should ensure immediate deployment of kernel updates containing this fix, particularly on systems running network services or those handling significant traffic control operations. Additionally, monitoring for anomalous netlink traffic patterns and implementing proper access controls for network configuration interfaces can help detect potential exploitation attempts. The ATT&CK framework categorizes this vulnerability under T1068: Exploitation for Privilege Escalation, as successful exploitation could allow attackers to gain kernel-level privileges. Organizations should also consider implementing kernel hardening measures such as stack canaries and control flow integrity checks to further reduce the attack surface and prevent exploitation of similar memory corruption vulnerabilities.