CVE-2026-64054 net: shaper: reject duplicate leaves in GROUP request
A double-free vulnerability in the Linux kernel's network shaper allows local attackers to cause a denial of service or potentially execute code via duplicate leaf handles.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64054?
CVE-2026-64054 is a high-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: shaper: reject duplicate leaves in GROUP request
net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in old_nodes[]. The cleanup loop double frees the parent. Of course the same parent may still be in old_nodes[] twice if we are moving multiple of its leaves.
Note that this patch also implicitly fixes the fact that the i >= leaves_count path forgets to set ret.
Weakness: CWE-415
Which versions are affected by CVE-2026-64054?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64054?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64054 being exploited?
There is no known exploitation of CVE-2026-64054 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64054, DEBIAN-CVE-2026-64054, GHSA-rwhp-fchm-v8mq, UBUNTU-CVE-2026-64054.