CVE-2026-64027: In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Rece
Summary
A race condition (a timing bug where two operations interfere with each other) exists in the Linux kernel's network shaper code because flags aren't stored safely alongside data in XArray (a special data structure for storing indexed items). This can cause a use-after-free bug (accessing memory that has already been freed), where a reader process might try to use an entry that a writer process has already replaced with something else. The fix converts the code to use an explicit valid field with proper memory barriers (synchronization mechanisms that ensure operations happen in the correct order) instead of relying on XArray marks.
Solution / Mitigation
Convert the code to use an explicit valid field with smp_load_acquire() / smp_store_release() barriers instead of XArray marks.
Vulnerability Details
EPSS: 0.0%
July 19, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-64027
First tracked: July 19, 2026 at 02:09 PM
Classified by LLM (prompt v3) · confidence: 95%