CVE-2026-64054: net: shaper: reject duplicate leaves in GROUP request
Vulnerability summary
CVE-2026-64054 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.4% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 64 · Related 64Timeline
- 19-07-2026PublishedVulnerability first disclosed.
Description
In the Linux kernel, the following vulnerability has been resolved: net: shaper: reject duplicate leaves in GROUP request net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplies the same leaf handle twice, the same old-parent pointer lands twice in old_nodes[]. The cleanup loop double frees the parent. Of course the same parent may still be in old_nodes[] twice if we are moving multiple of its leaves. Note that this patch also implicitly fixes the fact that the i >= leaves_count path forgets to set ret.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.13% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu118 products
- linux< 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e, < 5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75 | ≥ 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e, < 31767bf852b59f05125b58a17007e4cd1ea9eb2e | ≥ 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e, < a9a2fa1da619f276580b0d4c5d12efac89e8642b | 6.13
- linux_kernel≥ 6.13, < 6.18.34 | ≥ 6.19, < 7.0.11 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3
Debian1 product
- linux< 7.0.12-1
3 vendors · 121 products
