---
id: CVE-2026-23437
title: 'net: shaper: protect late read accesses to the hierarchy'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: shaper: protect late read accesses to the hierarchy

  We look up a netdev during prep of Netlink ops (pre- callbacks)
  and take a ref to it. Then later in the body o…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb <
    581eee0890a8bde44f1fb78ad3e70502a897d583
  - >-
    Linux >= 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb <
    348758ba74e6a348299965b16a97cfb817545cc0
  - >-
    Linux >= 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb <
    0f9ea7141f365b4f27226898e62220fb98ef8dc6
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:08:04.357382Z'
published: '2026-04-03'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:56.099Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23437'
references:
  - url: 'https://git.kernel.org/stable/c/581eee0890a8bde44f1fb78ad3e70502a897d583'
  - url: 'https://git.kernel.org/stable/c/348758ba74e6a348299965b16a97cfb817545cc0'
  - url: 'https://git.kernel.org/stable/c/0f9ea7141f365b4f27226898e62220fb98ef8dc6'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02133
ingestedAt: '2026-10-16T17:24:46.646Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: protect late read accesses to the hierarchy

We look up a netdev during prep of Netlink ops (pre- callbacks)
and take a ref to it. Then later in the body of the callback
we take its lock or RCU which are the actual protections.

This is not proper, a conversion from a ref to a locked netdev
must include a liveness check (a check if the netdev hasn't been
unregistered already). Fix the read cases (those under RCU).
Writes needs a separate change to protect from creating the
hierarchy after flush has already run.

## Affected

- `Linux >= 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb < 581eee0890a8bde44f1fb78ad3e70502a897d583`
- `Linux >= 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb < 348758ba74e6a348299965b16a97cfb817545cc0`
- `Linux >= 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb < 0f9ea7141f365b4f27226898e62220fb98ef8dc6`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.