Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: net: shaper: rework the VALID marking (again) Recent commit changed the… (CVE-2026-64027)

The Linux kernel's network shaper subsystem had a race condition due to non-atomic storage of flags in XArray entries. A recent commit changed the semantics of the VALID marking, but did not account for the race where a reader might observe a VALID mark, be interrupted, and then fetch a different pointer after a writer replaced the entry. This could cause a use-after-free (UAF) because net_shaper_rollback() assumed entries without VALID could be freed without RCU observation. The fix involved converting the code to use an explicit valid field with appropriate memory barriers (smp_load_acquire() / smp_store_release()) to prevent this race. The vulnerability is tracked as CVE-2026-64027 and affects numerous linux-hwe-edge kernel versions prior to 7.0.0-28.28 and others as listed. The vendor advisory confirms a patch is available.

Successful exploitation of this vulnerability could lead to use-after-free conditions in the kernel, potentially allowing local attackers to escalate privileges or cause system instability. The CVSS score of 7.8 (high severity) reflects the potential for high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

A patch addressing this vulnerability is available and should be applied promptly. The vendor advisory from Ubuntu (USN-8593-1 and USN-8603-1) details the fixed package versions. After updating the kernel packages, a system reboot is required to apply the fixes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully.