Linux Kernel EUVD-2026-45627

The Linux kernel's net/shaper subsystem provides QoS and traffic-shaping primitives exposed to userspace via netlink. The vulnerable function, net_shaper_nl_group_doit(), processes GROUP requests that accept a list of leaf shaper handles (NET_SHAPER_A_LEAVES attributes) to reorganize between parent shapers. Because the function performs no deduplication of leaf entries before populating the old_nodes[] array, a caller that supplies the same leaf handle twice causes the same parent pointer to occupy two slots in that array. The cleanup loop subsequently dereferences and frees that parent pointer twice, constituting a CWE-415 double-free. A secondary fix in the same patch addresses an unrelated deficiency where the i >= leaves_count error path failed to set the ret return value. CPE data (cpe:2.3:a:linux:linux) confirms this is the upstream Linux kernel; affected commit range is anchored at 5d5d4700e75d (the net shaper introduction) and resolved by stable commits a9a2fa1da619, 31767bf852b5, and 5098b223f0f0.