Linux EUVD-2026-18678

The Linux kernel's net shaper subsystem manages traffic shaping hierarchy through netlink operations. The vulnerability exists in the reference counting and synchronization model: netdev references are obtained during netlink pre-callbacks (prep phase) without subsequent liveness validation before RCU read-side critical sections in the callback body. This violates proper kernel synchronization patterns where a conversion from reference-counted access to RCU-protected access must include a check that the device hasn't been unregistered (netdev_is_rx_handler_busy or similar validation). The CWE classification is unavailable, but the root cause aligns with CWE-416 (Use After Free) and CWE-362 (Concurrent Modification) patterns. The shaper module uses RCU for read-side synchronization of hierarchy traversal, but the pre-ref and post-lock/RCU pattern creates a window where the netdev can transition to an unregistered state, causing the RCU-protected read to access freed or invalid hierarchy structures. The fix adds liveness checks during the read path; write-side protection requires separate changes to prevent hierarchy creation after flush operations have commenced.