---
id: CVE-2026-64054
title: 'net: shaper: reject duplicate leaves in GROUP request'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net: shaper: reject duplicate leaves in GROUP request

  net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES
  entries. When userspace supplies the same lea…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e <
    5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75
  - >-
    Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e <
    31767bf852b59f05125b58a17007e4cd1ea9eb2e
  - >-
    Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e <
    a9a2fa1da619f276580b0d4c5d12efac89e8642b
  - Linux 6.13
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:29:27.649176Z'
published: '2026-07-19'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:25.057Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64054'
references:
  - url: 'https://git.kernel.org/stable/c/5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75'
  - url: 'https://git.kernel.org/stable/c/31767bf852b59f05125b58a17007e4cd1ea9eb2e'
  - url: 'https://git.kernel.org/stable/c/a9a2fa1da619f276580b0d4c5d12efac89e8642b'
tags:
  - cve.org
epss: 0.00127
epssPercentile: 0.02411
ingestedAt: '2026-11-06T16:57:43.239Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: reject duplicate leaves in GROUP request

net_shaper_nl_group_doit() does not deduplicate NET_SHAPER_A_LEAVES
entries. When userspace supplies the same leaf handle twice, the same
old-parent pointer lands twice in old_nodes[]. The cleanup loop double
frees the parent. Of course the same parent may still be in old_nodes[]
twice if we are moving multiple of its leaves.

Note that this patch also implicitly fixes the fact that the
i >= leaves_count path forgets to set ret.

## Affected

- `Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < 5098b223f0f0c5c18a3884a8b0ea5bd4a0c7bd75`
- `Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < 31767bf852b59f05125b58a17007e4cd1ea9eb2e`
- `Linux >= 5d5d4700e75d861e83bf18eb6bf66ff90f85fe4e < a9a2fa1da619f276580b0d4c5d12efac89e8642b`
- `Linux 6.13`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.