The Linux kernel network shaper subsystem contains a race condition that allows a hierarchy structure to be allocated after a system flush has already finished, which leaks memory. The flaw arises because a network device reference is taken during the preparation of Netlink SET operations but the necessary lock is not acquired until later. If the device is unregistered in the meanwhile, the hierarchy allocation may occur after the flush, leaving references that are never freed. A leak of this nature can gradually exhaust kernel memory and potentially destabilize the system. The weakness is a classic race condition as identified by CWE‑367.

All Linux kernel builds that include the net: shaper code path and do not implement the pre‑locking change are vulnerable. This includes generic kernel releases up to 6.13 and the 7.0 release candidates (RC1 through RC7) that are still using the unpatched path. Distributions distributing these kernels without applying the patch are affected.

The CVSS score is 5.5, reflecting moderate severity. The EPSS score of < 1 % indicates that the probability of exploitation in the wild is very low, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local or privileged access to craft Netlink SET requests while a device is concurrently being unregistered or otherwise modified. Successful exploitation would mainly lead to memory leaks and, over time, could degrade performance or crash the kernel, but it does not directly provide code execution or privilege escalation.