LiveActive security incident?Get immediate response
CVE Record

CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request

In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in old_nodes[]. The cleanup loop double frees the parent. Of course the same parent may still be in old_nodes[] twice if we are moving multiple of its leaves. Note that this patch also implicitly fixes the fact that the i >= leaves_count path forgets to set ret.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel memory-management flaw in network shaper grouping. A malformed userspace GROUP request can cause the same parent object to be freed twice. The source does not provide CVSS, impact scope, privilege requirements, or evidence of exploitation.

Executive priority

Treat as a kernel patch-management item with uncertain severity. Prioritize internet-facing infrastructure hosts, multi-user systems, and platforms where local users or services may reach kernel network configuration interfaces.

Technical view

net_shaper_nl_group_doit failed to deduplicate NET_SHAPER_A_LEAVES entries. Supplying the same leaf handle twice could store the same old-parent pointer twice in old_nodes, leading the cleanup loop to double free it. The fix rejects duplicate leaves and also corrects a missing ret assignment path.

Likely exposure

Exposure appears limited to Linux systems with the affected net shaper kernel code reachable from userspace. The bundle lists Linux kernel versions including 6.13, 6.18.34, 7.0.11, and 7.1 as affected, but distro backports may differ.

Exploitation context

No active exploitation is indicated; KEV is false and the provided sources do not describe public exploitation. The input vector is a userspace GROUP request to the kernel net shaper interface, but required privileges are not stated in the bundle.

Researcher notes

The source bundle is narrow: no CVSS, CWE, privilege model, crash evidence, or exploitability analysis. The affected list also contains an ambiguous version value of 0. Analysis should stay tied to vendor kernel trees and the three stable commits.

Mitigation direction

  • Apply vendor kernel updates that include the referenced stable fixes.
  • Check distribution advisories before assuming upstream version numbers map directly.
  • Prioritize systems allowing untrusted local users or network-shaping administration.
  • Monitor Linux stable trees and vendor errata for affected-version clarification.
  • If patching is delayed, reduce unnecessary access to network-shaper administration paths.

Validation and detection

  • Inventory Linux kernel versions across servers, appliances, and container hosts.
  • Compare running kernels with vendor advisories for CVE-2026-64054.
  • Check whether referenced stable commits are included in deployed kernel source or changelogs.
  • Review access controls for users able to make net shaper GROUP requests.
  • Confirm post-update kernel package versions through standard asset management.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-64054 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e, 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e, 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4eunaffected
LinuxLinux6.13, 0, 6.18.34, 7.0.11, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.