CVE-2026-64027

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: shaper: rework the VALID marking (again)<br /> <br /> Recent commit changed the semantics from NOT_VALID to VALID.<br /> I didn&amp;#39;t realize that the flags are not stored atomically<br /> with the entry in XArray. There&amp;#39;s still a race of reader<br /> observing a VALID mark for a slot, getting interrupted,<br /> writer replacing the entry with a different one, reader<br /> continuing, fetching the entry which is now a different<br /> pointer than the pointer for which VALID was meant.<br /> <br /> The biggest consequence of this is that we may see a UAF<br /> since net_shaper_rollback() assumed that entries without<br /> VALID can be freed without observing RCU.<br /> <br /> Looks like the XArray marks are buying us nothing at this<br /> point. Let&amp;#39;s convert the code to an explicit valid field.<br /> The smp_load_acquire() / smp_store_release() barriers are<br /> marginally cleaner.