Linux CVE-2026-23436

The Linux kernel's network shaper subsystem manages traffic control hierarchies via Netlink operations. The vulnerability exists in the interaction between device reference counting, instance locking, and netdev unregistration handlers. During Netlink operation preparation (pre-callbacks), the code acquires a reference to a netdev device but defers instance lock acquisition until the actual callback body. The underlying issue is a time-of-check-to-time-of-use (TOCTOU) race condition: if the netdev unregisters between reference acquisition and lock acquisition, the flush handler may have already executed, leaving the hierarchy uninitialized. Subsequent hierarchy allocation proceeds without proper synchronization, creating a use-after-free or memory leak vector. The fix consolidates locking into the pre-callback phase via commits 719f6784f918f9e32f3ff3b197f900e852223f9d, d22921727023e7852704965e935f4d1fc83a5ec9, and d75ec7e8ba1979a1eb0b9211d94d749cdce849c8, eliminating the window between reference and lock acquisition.