CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request
In the Linux kernel, the following vulnerability has been resolved:
net: shaper: reject duplicate leaves in GROUP request
netshapernlgroupdoit() does not deduplicate NETSHAPERALEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in oldnodes[]. The cleanup loop double frees the parent. Of course the same parent may still be in oldnodes[] twice if we are moving multiple of its leaves.
Note that this patch also implicitly fixes the fact that the i >= leavescount path forgets to set ret.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
Exploitation requires local access with low privileges. No user interaction is required.
What should teams do to remediate the issue?
Apply an available Linux kernel patch addressing the duplicate-leaf handling in shaper GROUP requests. No alternative mitigation is provided in the available data.