FlawAtlas
Search the atlas
CVE-2026-23437 Not scored

net: shaper: protect late read accesses to the hierarchy

In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is not proper, a conversion from a ref to a locked netdev must include a liveness check (a check if the netdev hasn't been unregistered already). Fix the read cases (those under RCU). Writes needs a separate change to protect from creating the hierarchy after flush has already run.

Exploit probability 0.1%
Published April 3, 2026
Required by Not available
Last source change July 15, 2026

02 / AFFECTED SOFTWARE

Affected packages

Linux Kernel
Unknown Unknown

03 / CONNECTIONS

Connected vulnerabilities

related OPENSUSE-SU-2026:20826-1
related SUSE-SU-2026:21519-1
related SUSE-SU-2026:21520-1
related SUSE-SU-2026:21521-1
related SUSE-SU-2026:21522-1
related SUSE-SU-2026:21523-1
related SUSE-SU-2026:21524-1
related SUSE-SU-2026:21525-1
related SUSE-SU-2026:21526-1
related SUSE-SU-2026:21527-1
related SUSE-SU-2026:21528-1
related SUSE-SU-2026:21529-1
related SUSE-SU-2026:21530-1
related SUSE-SU-2026:21531-1
related SUSE-SU-2026:21532-1
related SUSE-SU-2026:21533-1
related SUSE-SU-2026:21554-1
related SUSE-SU-2026:21555-1
related SUSE-SU-2026:21556-1
related SUSE-SU-2026:21557-1
related SUSE-SU-2026:21558-1
related SUSE-SU-2026:21562-1
related SUSE-SU-2026:21563-1
related SUSE-SU-2026:21591-1
related SUSE-SU-2026:21598-1
related SUSE-SU-2026:21841-1
related SUSE-SU-2026:21845-1
related SUSE-SU-2026:21860-1

04 / EVIDENCE

Source records

Open Source Vulnerabilities CVE-2026-23437

In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is not proper, a conversion from a ref to a locked netdev must include a liveness check (a check if the netdev hasn't been unregistered already). Fix the read cases (those under RCU). Writes needs a separate change to protect from creating the hierarchy after flush has already run.

View original source

05 / REFERENCES

Further evidence