CVE-2026-64027

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the network shaper component due to the non-atomic storage of flags within the XArray. A reader may observe a VALID mark for a slot but be interrupted before fetching the entry. If a writer replaces the entry during this interval, the reader may fetch a different pointer than the one intended for the VALID mark. This can lead to a Use-After-Free (UAF) condition because the net shaper rollback() function assumes that entries lacking the VALID mark can be freed without observing Read-Copy-Update (RCU), a mechanism used to synchronize access to shared data. To resolve this, the marking system is replaced with an explicit valid field using smp load acquire() and smp store release() memory barriers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.