Race condition in Linux kernel - CVE-2026-23437

Vulnerability identifier: #VU124932

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-23437

CWE-ID: CWE-362

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper locking and missing liveness check in the net: shaper hierarchy handling when processing netlink operations that read the hierarchy under RCU. A local user can send specially crafted netlink requests to cause a denial of service.

The issue occurs because a net device reference obtained during netlink operation preparation may later be accessed under RCU without verifying that the device is still live and has not already been unregistered.

Linux kernel
SUSE Linux Micro
kernel-livepatch-SLE16_Update_11-debugsource
kernel-livepatch-6_12_0-160000_32-default-debuginfo
kernel-livepatch-6_12_0-160000_32-default
kernel-livepatch-6_12_0-160000_31-default
kernel-livepatch-SLE16_Update_10-debugsource
kernel-livepatch-6_12_0-160000_31-default-debuginfo

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-livepatch-SLE16_Update_11-debugsource - update to 2-160000.1.1
kernel-livepatch-6_12_0-160000_32-default-debuginfo - update to 2-160000.1.1
kernel-livepatch-6_12_0-160000_32-default - update to 2-160000.1.1
kernel-livepatch-6_12_0-160000_31-default - update to 2-160000.1.1
kernel-livepatch-SLE16_Update_10-debugsource - update to 2-160000.1.1
kernel-livepatch-6_12_0-160000_31-default-debuginfo - update to 2-160000.1.1

• https://git.kernel.org/stable/c/0f9ea7141f365b4f27226898e62220fb98ef8dc6
• https://git.kernel.org/stable/c/348758ba74e6a348299965b16a97cfb817545cc0
• https://git.kernel.org/stable/c/581eee0890a8bde44f1fb78ad3e70502a897d583

• Race condition in Linux kernel shaper
• SUSE update for the Linux Kernel (Live Patch 11 for SUSE Linux Enterprise 16)
• SUSE update for the Linux Kernel (Live Patch 10 for SUSE Linux Enterprise 16)