{"id":"CVE-2026-64054","title":"net: shaper: reject duplicate leaves in GROUP request","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: shaper: reject duplicate leaves in GROUP request\n\nnet_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES\nentries. When userspace supplies the same lea…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < 5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75","Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < 31767bf852b59f05125b58a17007e4cd1ea9eb2e","Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < a9a2fa1da619f276580b0d4c5d12efac89e8642b","Linux 6.13"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:29:27.649176Z"},"published":"2026-07-19","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:25.057Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64054","references":[{"url":"https://git.kernel.org/stable/c/5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75"},{"url":"https://git.kernel.org/stable/c/31767bf852b59f05125b58a17007e4cd1ea9eb2e"},{"url":"https://git.kernel.org/stable/c/a9a2fa1da619f276580b0d4c5d12efac89e8642b"}],"tags":["cve.org"],"epss":0.00127,"epssPercentile":0.02411,"ingestedAt":"2026-11-06T16:57:43.239Z","slug":"CVE-2026-64054","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet: shaper: reject duplicate leaves in GROUP request\n\nnet_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES\nentries. When userspace supplies the same leaf handle twice, the same\nold-parent pointer lands twice in old_nodes[]. The cleanup loop double\nfrees the parent. Of course the same parent may still be in old_nodes[]\ntwice if we are moving multiple of its leaves.\n\nNote that this patch also implicitly fixes the fact that the\ni >= leaves_count path forgets to set ret.\n\n## Affected\n\n- `Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < 5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75`\n- `Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < 31767bf852b59f05125b58a17007e4cd1ea9eb2e`\n- `Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < a9a2fa1da619f276580b0d4c5d12efac89e8642b`\n- `Linux 6.13`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}