Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0013 2.1 —
AFFECTED Product Versions Fixed Linux 4b623f9f0f59652ea71fcb27d60b4c3b65126dbb – — Linux 6.13 – 6.18.20
TIMELINE Jan 13 Reserved by Linux Apr 3 Published (CNA: Linux) Oct 16 RESCORED — CVE-2026-23437 (Linux). CVSS 7.8 → 5.5 (NVD).
In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops (pre- callbacks) and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual protections. This is not proper, a conversion from a ref to a locked netdev must include a liveness check (a check if the netdev hasn't been unregistered already). Fix the read cases (those under RCU). Writes needs a separate change to protect from creating the hierarchy after flush has already run.
| Date | Event | Detail |
|---|---|---|
| January 13, 2026 | Reserved | Reserved by Linux |
| April 3, 2026 | Published | Published (CNA: Linux) |
| October 16, 2026 | RESCORED | RESCORED — CVE-2026-23437 (Linux). CVSS 7.8 → 5.5 (NVD). |
Authoritative record: CVE-2026-23437 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-23437 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
