CVE-2026-23436: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23436 is a race condition vulnerability in the Linux kernel's network shaper (net: shaper) subsystem that can lead to kernel memory leaks and denial of service. The flaw was published on April 3, 2026, and affects Linux kernel versions 6.13.1 through 6.18.19, 6.19 through 6.19.9, and the 6.13 release, as well as pre-release 7.0 release candidates (rc1–rc7). It carries a CVSS v3.1 base score of 5.5 (Medium), requiring local access and low privileges to exploit (GitHub Advisory, Feedly).

The root cause is a time-of-check to time-of-use (TOCTOU) race condition (related to CWE-362: Concurrent Execution Using Shared Resource with Improper Synchronization) in the kernel's network shaper component. During Netlink SET operations, the kernel looks up a network device (netdev) and takes a reference to it in the pre-callback phase, but only acquires the instance lock later in the callback body. If the netdev is unregistered between the reference being taken and the lock being acquired, a hierarchy allocation can occur after the flush operation has already completed, resulting in a kernel memory leak. The fix moves the instance lock acquisition into the pre-callback phase, eliminating the race and removing the need for dedicated lock/unlock callbacks (GitHub Advisory).

Successful exploitation causes kernel memory exhaustion through repeated, unreclaimed hierarchy allocations in the network shaper subsystem, ultimately resulting in a denial of service condition. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability. Because exploitation requires local access with low privileges, the blast radius is constrained to the affected host, with no direct path to lateral movement or data exfiltration (GitHub Advisory, Feedly).

Update the Linux kernel to a patched version: 6.18.20, 6.19.10, or 7.0-rc5 and later. Specific upstream patch commits are available at git.kernel.org/stable/c/719f6784f918f9e32f3ff3b197f900e852223f9d, d22921727023e7852704965e935f4d1fc83a5ec9, and d75ec7e8ba1979a1eb0b9211d94d749cdce849c8. As interim mitigations, restrict local user access and limit privileges for accounts that can perform network shaper SET operations; monitor kernel memory usage for unexplained growth. Downstream distributions including Amazon Linux 2023, SUSE, and openSUSE have issued updated packages (GitHub Advisory, Amazon Linux Advisory, SUSE Advisory).

The vulnerability was announced via the official Linux kernel CVE mailing list and subsequently tracked by downstream distributions including Amazon Linux 2023, SUSE, and the Yocto Project security list, which issued advisories and updated packages. Tenable published multiple Nessus detection plugins (IDs 304966, 311340, 318240, 319659) and Qualys added a detection check (762889). No notable independent researcher commentary or significant social media discussion has been observed, consistent with the moderate severity and lack of active exploitation (Feedly).