The Linux kernel vulnerability CVE-2026-64054 concerns the net_shaper_nl_group_doit() function, which failed to deduplicate NET_SHAPER_A_LEAVES entries. When userspace supplied duplicate leaf handles, the same old-parent pointer was stored multiple times in old_nodes[], causing the cleanup loop to double free the parent pointer. This double free can lead to memory corruption or kernel instability. Additionally, the patch addressed an issue where the code path for i >= leaves_count did not set the return value 'ret', potentially causing undefined behavior.

The vulnerability can lead to double free of kernel memory, which may result in memory corruption, kernel crashes, or potential escalation of privileges if exploited. However, no known exploits in the wild have been reported. The impact is limited to systems running the affected Linux kernel versions with the vulnerable net shaper code.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel updates or patches that include this fix to remediate the issue. Since this is not a cloud service, system administrators must update their Linux kernel versions accordingly. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor or Linux kernel advisories for the current remediation guidance and apply updates as recommended.