Executive brief
A vulnerability was identified in the Linux kernel's network shaping component, which manages how data traffic is prioritized and throttled. An error in how the system handles internal memory buffers could allow a local user to trigger a system crash or potentially gain unauthorized elevated privileges. This issue affects the stability and security of the operating system, potentially leading to service disruptions or a full system compromise.
Technical details
A double-free vulnerability exists in the net-shapers component of the Linux kernel within the net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() functions. The root cause is improper error handling where nlmsg_free(msg) is called after genlmsg_reply() has already consumed or freed the socket buffer (skb) on an error path. A local attacker with access to Netlink interfaces could exploit this to trigger memory corruption. This can lead to a kernel panic (Denial of Service) or potentially local privilege escalation. The issue has been resolved by ensuring the error from genlmsg_reply() is returned directly without re-attempting to free the message buffer.
Affected products
- Linux Linux Kernel 6.12 and later
Timeline
- 2026-03-09: other: Patch submitted by Paul Moses
- 2026-05-13: advisory: CVE-2026-43481 published