The vulnerability occurs in the Linux kernel networking shaper subsystem. When a userspace application submits a netlink GROUP request that lists the same leaf handle more than once, the kernel fails to deduplicate the entries. The duplicate leaf handles cause the same parent pointer to be pushed twice into the old_nodes[] array, leading the cleanup loop to double-free the parent object. This double-free can corrupt kernel memory, possibly triggering a crash or providing an attack surface for more advanced exploitation.

All Linux kernel installations that include the net_shaper module and that have not yet applied the patch are potentially affected. The specific kernel version ranges are not disclosed in the CVE record, so any kernel prior to the change that implements the double-free fix is at risk. Administrators should review whether their deployments use net_shaper functionality and identify the current kernel version.

The CVSS score of 7.0 indicates a moderate to high risk level, while the EPSS score of less than 1% suggests that exploitation is not widely observed but still possible. This issue is not listed in the CISA KEV catalog, implying it has not yet been publicly exploited on a wide scale. Based on the description, it is inferred that the attack requires a user with sufficient privileges to send a netlink GROUP request that includes duplicate leaf handles. The attack vector is inferred to be local, as it depends on a local userspace process interacting with the shaper subsystem. The double-free could produce a denial-of-service by crashing the kernel or could be leveraged for privilege escalation if an attacker can control the freed memory.