Executive brief
A vulnerability in the Linux kernel's network traffic shaping component could allow a local user to cause a system resource leak. This occurs due to a race condition when network devices are unregistered while traffic shaping hierarchies are being created. Over time, these leaks could impact system stability or lead to a denial-of-service condition.
Technical details
A race condition exists in the net:shaper component of the Linux kernel during Netlink operations. The vulnerability occurs because the kernel takes a reference to a network device (netdev) during the 'pre-' callback phase but does not acquire the necessary locks until the main callback body. If a netdev is unregistered between these two phases, the kernel may allocate a shaper hierarchy after the flush operation has already completed, resulting in a memory leak. The fix involves moving the instance lock acquisition to the 'pre-' callback phase to ensure atomicity relative to device unregistration. This affects SET operations within the Netlink interface.
Affected products
- Linux Linux Kernel 6.13 through 6.18.19, 6.19 through 6.19.9
Timeline
- 2026-03-17: other: Original patch authored
- 2026-03-25: patched: Patch committed to stable tree
- 2026-04-03: advisory: CVE published