CVE-2026-23436

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23436", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.017Z", "datePublished": "2026-04-03T15:15:21.280Z", "dateUpdated": "2026-11-05T21:33:46.717Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:06:52.320Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: shaper: protect from late creation of hierarchy\n\nWe look up a netdev during prep of Netlink ops (pre- callbacks)\nand take a ref to it. Then later in the body of the callback\nwe take its lock or RCU which are the actual protections.\n\nThe netdev may get unregistered in between the time we take\nthe ref and the time we lock it. We may allocate the hierarchy\nafter flush has already run, which would lead to a leak.\n\nTake the instance lock in pre- already, this saves us from the race\nand removes the need for dedicated lock/unlock callbacks completely.\nAfter all, if there's any chance of write happening concurrently\nwith the flush - we're back to leaking the hierarchy.\n\nWe may take the lock for devices which don't support shapers but\nwe're only dealing with SET operations here, not taking the lock\nwould be optimizing for an error case."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/netlink/specs/net_shaper.yaml", "net/shaper/shaper.c", "net/shaper/shaper_nl_gen.c", "net/shaper/shaper_nl_gen.h"], "versions": [{"version": "93954b40f6a4fc43226c01a15b02732f884500f1", "lessThan": "719f6784f918f9e32f3ff3b197f900e852223f9d", "status": "affected", "versionType": "git"}, {"version": "93954b40f6a4fc43226c01a15b02732f884500f1", "lessThan": "d22921727023e7852704965e935f4d1fc83a5ec9", "status": "affected", "versionType": "git"}, {"version": "93954b40f6a4fc43226c01a15b02732f884500f1", "lessThan": "d75ec7e8ba1979a1eb0b9211d94d749cdce849c8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["Documentation/netlink/specs/net_shaper.yaml", "net/shaper/shaper.c", "net/shaper/shaper_nl_gen.c", "net/shaper/shaper_nl_gen.h"], "versions": [{"version": "6.13", "status": "affected"}, {"version": "0", "lessThan": "6.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.20", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.10", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.18.20"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "6.19.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.13", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/719f6784f918f9e32f3ff3b197f900e852223f9d"}, {"url": "https://git.kernel.org/stable/c/d22921727023e7852704965e935f4d1fc83a5ec9"}, {"url": "https://git.kernel.org/stable/c/d75ec7e8ba1979a1eb0b9211d94d749cdce849c8"}], "title": "net: shaper: protect from late creation of hierarchy", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23436", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:30:39.794432Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:46.717Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23436", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:30:39.794432Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:30:40.750Z"}}], "cna": {"title": "net: shaper: protect from late creation of hierarchy", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "93954b40f6a4fc43226c01a15b02732f884500f1", "lessThan": "719f6784f918f9e32f3ff3b197f900e852223f9d", "versionType": "git"}, {"status": "affected", "version": "93954b40f6a4fc43226c01a15b02732f884500f1", "lessThan": "d22921727023e7852704965e935f4d1fc83a5ec9", "versionType": "git"}, {"status": "affected", "version": "93954b40f6a4fc43226c01a15b02732f884500f1", "lessThan": "d75ec7e8ba1979a1eb0b9211d94d749cdce849c8", "versionType": "git"}], "programFiles": ["Documentation/netlink/specs/net_shaper.yaml", "net/shaper/shaper.c", "net/shaper/shaper_nl_gen.c", "net/shaper/shaper_nl_gen.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"status": "unaffected", "version": "0", "lessThan": "6.13", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.20", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.10", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["Documentation/netlink/specs/net_shaper.yaml", "net/shaper/shaper.c", "net/shaper/shaper_nl_gen.c", "net/shaper/shaper_nl_gen.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/719f6784f918f9e32f3ff3b197f900e852223f9d"}, {"url": "https://git.kernel.org/stable/c/d22921727023e7852704965e935f4d1fc83a5ec9"}, {"url": "https://git.kernel.org/stable/c/d75ec7e8ba1979a1eb0b9211d94d749cdce849c8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: shaper: protect from late creation of hierarchy\n\nWe look up a netdev during prep of Netlink ops (pre- callbacks)\nand take a ref to it. Then later in the body of the callback\nwe take its lock or RCU which are the actual protections.\n\nThe netdev may get unregistered in between the time we take\nthe ref and the time we lock it. We may allocate the hierarchy\nafter flush has already run, which would lead to a leak.\n\nTake the instance lock in pre- already, this saves us from the race\nand removes the need for dedicated lock/unlock callbacks completely.\nAfter all, if there's any chance of write happening concurrently\nwith the flush - we're back to leaking the hierarchy.\n\nWe may take the lock for devices which don't support shapers but\nwe're only dealing with SET operations here, not taking the lock\nwould be optimizing for an error case."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.13"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:06:52.320Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23436", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:46.717Z", "dateReserved": "2026-01-13T15:37:46.017Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-03T15:15:21.280Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["Documentation/netlink/specs/net_shaper.yaml", "net/shaper/shaper.c", "net/shaper/shaper_nl_gen.c", "net/shaper/shaper_nl_gen.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "719f6784f918f9e32f3ff3b197f900e852223f9d", "status": "affected", "version": "93954b40f6a4fc43226c01a15b02732f884500f1", "versionType": "git"}, {"lessThan": "d22921727023e7852704965e935f4d1fc83a5ec9", "status": "affected", "version": "93954b40f6a4fc43226c01a15b02732f884500f1", "versionType": "git"}, {"lessThan": "d75ec7e8ba1979a1eb0b9211d94d749cdce849c8", "status": "affected", "version": "93954b40f6a4fc43226c01a15b02732f884500f1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["Documentation/netlink/specs/net_shaper.yaml", "net/shaper/shaper.c", "net/shaper/shaper_nl_gen.c", "net/shaper/shaper_nl_gen.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.13"}, {"lessThan": "6.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.20", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A2A94618-E3D4-4741-B60F-78501912CE89", "versionEndExcluding": "6.18.20", "versionStartIncluding": "6.13.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D34333-38BE-4414-9E79-6EB764329581", "versionEndExcluding": "6.19.10", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.13:-:*:*:*:*:*:*", "matchCriteriaId": "5A3F9505-6B98-4269-8B81-127E55A1BF00", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: shaper: protect from late creation of hierarchy\n\nWe look up a netdev during prep of Netlink ops (pre- callbacks)\nand take a ref to it. Then later in the body of the callback\nwe take its lock or RCU which are the actual protections.\n\nThe netdev may get unregistered in between the time we take\nthe ref and the time we lock it. We may allocate the hierarchy\nafter flush has already run, which would lead to a leak.\n\nTake the instance lock in pre- already, this saves us from the race\nand removes the need for dedicated lock/unlock callbacks completely.\nAfter all, if there's any chance of write happening concurrently\nwith the flush - we're back to leaking the hierarchy.\n\nWe may take the lock for devices which don't support shapers but\nwe're only dealing with SET operations here, not taking the lock\nwould be optimizing for an error case."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet: shaper: proteger de la creaci\u00f3n tard\u00eda de la jerarqu\u00eda\n\nBuscamos un netdev durante la preparaci\u00f3n de las operaciones de Netlink (callbacks previos) y tomamos una referencia a \u00e9l. Luego, m\u00e1s tarde, en el cuerpo del callback, tomamos su bloqueo o RCU, que son las protecciones reales.\n\nEl netdev puede ser dado de baja entre el momento en que tomamos la referencia y el momento en que lo bloqueamos. Podemos asignar la jerarqu\u00eda despu\u00e9s de que el vaciado ya se haya ejecutado, lo que llevar\u00eda a una fuga.\n\nTomar el bloqueo de instancia ya en pre-, esto nos salva de la condici\u00f3n de carrera y elimina por completo la necesidad de callbacks dedicados de bloqueo/desbloqueo. Despu\u00e9s de todo, si hay alguna posibilidad de que una escritura ocurra concurrentemente con el vaciado, volvemos a la fuga de la jerarqu\u00eda.\n\nPodemos tomar el bloqueo para dispositivos que no soportan shapers, pero aqu\u00ed solo estamos tratando con operaciones SET; no tomar el bloqueo ser\u00eda optimizar para un caso de error."}], "id": "CVE-2026-23436", "lastModified": "2026-11-05T22:18:25.957", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23436", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:30:39.794432Z", "version": "2.0.3"}}]}, "published": "2026-04-03T16:16:25.257", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/719f6784f918f9e32f3ff3b197f900e852223f9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d22921727023e7852704965e935f4d1fc83a5ec9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d75ec7e8ba1979a1eb0b9211d94d749cdce849c8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: shaper: protect from late creation of hierarchy", "id": "2454831", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454831"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's network shaper module. A race condition can occur when a network device (netdev) is unregistered while its hierarchy is being created. This timing issue may allow the system to allocate resources that are not properly released, leading to a memory leak."], "name": "CVE-2026-23436", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-03T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23436\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23436\nhttps://lore.kernel.org/linux-cve-announce/2026040312-CVE-2026-23436-f1f8@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93954b40f6a4fc43226c01a15b02732f884500f1,719f6784f918f9e32f3ff3b197f900e852223f9d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93954b40f6a4fc43226c01a15b02732f884500f1,d22921727023e7852704965e935f4d1fc83a5ec9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[93954b40f6a4fc43226c01a15b02732f884500f1,d75ec7e8ba1979a1eb0b9211d94d749cdce849c8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.13"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.13)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.20,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.10,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T21:48:14.620882+00:00", "value": {"mitigation_remediation": ["Upgrade the Linux kernel to a version that includes the patched net: shaper subsystem", "Review the changelog or vendor advisories to confirm that the pre\u2011locking change is present", "If an immediate upgrade is not possible, avoid creating or modifying shapers during periods of device churn and monitor system logs for abnormal memory usage patterns", "When a patch is applied, perform kernel memory inspection to ensure that any previously allocated hierarchy objects are reclaimed"], "summary": {"action": "Patch Now", "impact": "Memory Leak"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that include the net: shaper code path and do not implement the pre\u2011locking change are vulnerable. This includes generic kernel releases up to 6.13 and the 7.0 release candidates (RC1 through RC7) that are still using the unpatched path. Distributions distributing these kernels without applying the patch are affected.", "description_and_impact": "The Linux kernel network shaper subsystem contains a race condition that allows a hierarchy structure to be allocated after a system flush has already finished, which leaks memory. The flaw arises because a network device reference is taken during the preparation of Netlink SET operations but the necessary lock is not acquired until later. If the device is unregistered in the meanwhile, the hierarchy allocation may occur after the flush, leaving references that are never freed. A leak of this nature can gradually exhaust kernel memory and potentially destabilize the system. The weakness is a classic race condition as identified by CWE\u2011367.", "risk_and_exploitability": "The CVSS score is 5.5, reflecting moderate severity. The EPSS score of <\u202f1\u202f% indicates that the probability of exploitation in the wild is very low, and the flaw is not listed in CISA\u2019s KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to craft Netlink SET requests while a device is concurrently being unregistered or otherwise modified. Successful exploitation would mainly lead to memory leaks and, over time, could degrade performance or crash the kernel, but it does not directly provide code execution or privilege escalation."}}}}, "created": "2026-04-03T21:14:02.127499+00:00", "updated": "2026-04-28T22:00:14.106884+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}