net: shaper: reject duplicate leaves in GROUP request
Summary
| CVE | CVE-2026-64054 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-19 16:17:45 UTC |
| Updated | 2026-07-19 16:17:45 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in old_nodes[]. The cleanup loop double frees the parent. Of course the same parent may still be in old_nodes[] twice if we are moving multiple of its leaves. Note that this patch also implicitly fixes the fact that the i >= leaves_count path forgets to set ret. |
Risk And Classification
EPSS: 0.001660000 probability, percentile 0.061640000 (date 2026-07-20)
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e 5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75 git | Not specified |
| CNA | Linux | Linux | affected 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e 31767bf852b59f05125b58a17007e4cd1ea9eb2e git | Not specified |
| CNA | Linux | Linux | affected 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e a9a2fa1da619f276580b0d4c5d12efac89e8642b git | Not specified |
| CNA | Linux | Linux | affected 6.13 | Not specified |
| CNA | Linux | Linux | unaffected 6.13 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.34 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.0.11 7.0.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/a9a2fa1da619f276580b0d4c5d12efac89e8642b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/31767bf852b59f05125b58a17007e4cd1ea9eb2e | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.