CVE-2026-23437

A flaw was found in the Linux kernel's net: shaper module. This vulnerability arises from a missing liveness check during Netlink operations when a network device (netdev) is referenced and subsequently accessed. If the netdev is unregistered before the access, it can lead to a use-after-free condition. This could allow an attacker to cause a denial of service.

This vulnerability requires a race condition between Netlink operations and network device unregistration. The attacker needs local access to trigger netlink operations while simultaneously causing device unregistration. The AC:H rating appropriately reflects the difficulty of exploiting this timing-dependent issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.