A flaw in the Linux kernel’s net-shapers implementation causes a double free of a socket buffer after a genlmsg_reply call fails. The duplicated free can corrupt kernel memory, potentially leading to a kernel panic or arbitrary code execution if an attacker can trigger the failure path. Thus, the primary impact is disruption of system availability or possible local privilege escalation on a vulnerable host.

The vulnerability affects the Linux kernel, specifically the net-shapers code path that handles netlink replies. All kernel versions that contain the problematic net_shapers logic and have not yet incorporated the recent patch (identified by commit 57885276cc16a2e2b76282c808a4e84cbecb3aae) are susceptible. No specific version numbers are listed, so the risk applies to any Linux kernel running an unpatched net_shapers implementation.

The CVSS score of 7.0 indicates a high severity vulnerability. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploits yet. The likely attack vector is local: an attacker with privileges to send crafted netlink messages to the kernel can invoke the buggy path. Due to the lack of publicly reported exploits, the risk is moderate to high for organizations running affected kernels, especially those with exposed netlink interfaces or root access. The potential for denial of service or privilege escalation warrants prompt remediation.