Skip to main content

Linux Kernel EUVDEUVD-2026-45600

| CVE-2026-64027 HIGH
2026-07-19 Linux GHSA-p8c9-j99c-x8w3
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local privileged access to the netlink shaper API (AV:L/PR:L); AC:H because it is a timing-dependent race that must be won; UAF yields high C/I/A within the kernel (S:U).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 16:56 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 7.8
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: rework the VALID marking (again)

Recent commit changed the semantics from NOT_VALID to VALID. I didn't realize that the flags are not stored atomically with the entry in XArray. There's still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant.

The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU.

Looks like the XArray marks are buying us nothing at this point. Let's convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner.

AnalysisAI

Use-after-free in the Linux kernel's net shaper subsystem allows a local, low-privileged attacker to trigger memory corruption via a race condition in the network shaper API's XArray-based entry tracking. Because XArray 'VALID' marks are not stored atomically with their entries, a reader can observe a VALID slot, be preempted while a writer replaces the entry, and then dereference a stale pointer that net_shaper_rollback() has already freed, enabling potential privilege escalation or information disclosure. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 6th percentile).

Technical ContextAI

The affected component is the Linux kernel net shaper subsystem (net/shaper/), which manages hierarchical traffic-shaping/QoS objects exposed via a netlink-based network shaper API. The subsystem stores shaper handles in an XArray and previously relied on XArray tag/mark bits (recently flipped from NOT_VALID to VALID semantics) to determine whether a slot could be freed. The root cause is a classic use-after-free (CWE-416) rooted in a data race: XArray marks are not updated atomically together with the entry pointer, so a reader that sees the VALID mark and is then interrupted can proceed to fetch an entry the writer has since swapped for a different pointer. net_shaper_rollback() assumed non-VALID entries could be freed without RCU synchronization, which combined with the racing reader produces a stale-pointer dereference. The fix replaces the fragile XArray mark scheme with an explicit 'valid' field guarded by smp_load_acquire()/smp_store_release() memory barriers to establish proper ordering.

RemediationAI

Patch available per vendor advisory: upgrade to a fixed stable kernel - 6.18.34, 7.0.11, or 7.1 or later per the EUVD data - or apply the corresponding upstream fix commits from git.kernel.org (2417df5e7bb4184b9d3a2988036bf2c46e594545, 96ea960dd40fd55302e0fd755176f26a95e6a50c, b8d7519352ba8c6df83259295d4a3bad093cae90), which replace the XArray VALID mark with an explicit valid field protected by acquire/release barriers. Rebuild or install the distribution kernel package incorporating these commits and reboot into the patched kernel. If immediate patching is not possible, compensating controls target the attack surface rather than the bug: restrict who can configure network shaping by limiting CAP_NET_ADMIN and access to the net shaper netlink API (the shaper handles are operated via privileged netlink calls), and avoid granting untrusted users the low-privilege local access required - trade-off is that legitimate QoS/traffic-shaping management by those accounts is also blocked. There is no meaningful data-plane workaround since the flaw is in the control-path object lifecycle. Track the fix via https://nvd.nist.gov/vuln/detail/CVE-2026-64027 and your distribution's advisory.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45600 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy