Executive brief
A vulnerability was identified in the Linux kernel's network shaper component, which manages how network traffic is prioritized and throttled. A technical flaw in how the system tracks valid configuration entries could allow a race condition to occur. In practice, this could lead to a system crash or unpredictable behavior (use-after-free) when network settings are modified or rolled back.
Technical details
A race condition exists in the net shaper component of the Linux kernel due to the non-atomic nature of XArray marks. Specifically, a reader may observe a 'VALID' mark for a slot, but if interrupted, a writer can replace the entry before the reader fetches the pointer. This mismatch results in the reader processing a different pointer than intended. The primary security impact is a Use-After-Free (UAF) in net_shaper_rollback(), which incorrectly assumed that entries without the VALID mark could be freed without RCU grace periods. The fix replaces XArray marks with an explicit 'valid' field in the shaper structure protected by smp_load_acquire and smp_store_release barriers.
Affected products
- Linux Linux 6.13 to 6.18.33, 7.0.10
Timeline
- 2026-05-15: patched: Initial fix developed by Jakub Kicinski
- 2026-07-19: disclosed: CVE published