https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 02:56:32 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64027 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: shaper: rework the VALID marking (again)</p> <p>Recent commit changed the semantics from NOT_VALID to VALID. I didn&#39;t realize that the flags are not stored atomically with the entry in XArray. There&#39;s still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant.</p> <p>The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU.</p> <p>Looks like the XArray marks are buying us nothing at this point. Let&#39;s convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: shaper: rework the VALID marking (again)</p> <p>Recent commit changed the semantics from NOT_VALID to VALID. I didn&#39;t realize that the flags are not stored atomically with the entry in XArray. There&#39;s still a race of reader observing a VALID mark for a slot, getting interrupted, writer replacing the entry with a different one, reader continuing, fetching the entry which is now a different pointer than the pointer for which VALID was meant.</p> <p>The biggest consequence of this is that we may see a UAF since net_shaper_rollback() assumed that entries without VALID can be freed without observing RCU.</p> <p>Looks like the XArray marks are buying us nothing at this point. Let&#39;s convert the code to an explicit valid field. The smp_load_acquire() / smp_store_release() barriers are marginally cleaner.</p> https://vulnerability.circl.lu/vuln/cve-2026-64027