Linux Kernel up to 6.18.19/6.19.9/7.0-rc4 information disclosure

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.18.19/6.19.9/7.0-rc4. It has been declared as critical. This impacts an unknown function. Executing a manipulation can lead to information disclosure. The identification of this vulnerability is CVE-2026-23437. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Linux Kernel up to 6.18.19/6.19.9/7.0-rc4 and classified as problematic. This vulnerability affects some unknown processing. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is not proper, a conversion from a ref to a locked netdev must include a liveness check (a check if the netdev hasn't been unregistered already). Fix the read cases (those under RCU). Writes needs a separate change to protect from creating the hierarchy after flush has already run.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2026-23437 since 01/13/2026. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 04/03/2026). The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 6.18.20, 6.19.10 or 7.0-rc5 eliminates this vulnerability. Applying the patch 581eee0890a8bde44f1fb78ad3e70502a897d583/348758ba74e6a348299965b16a97cfb817545cc0/0f9ea7141f365b4f27226898e62220fb98ef8dc6 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 6.19.7
• 6.19.8
• 6.19.9
• 7.0-rc1
• 7.0-rc2
• 7.0-rc3
• 7.0-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion