CVE-2026-64027: net: shaper: rework the VALID marking (again)

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: shaper: rework the VALID marking (again)

Recent commit changed the semantics from NOT_VALID to VALID.
I didn't realize that the flags are not stored atomically
with the entry in XArray. There's still a race of reader
observing a VALID mark for a slot, getting interrupted,
writer replacing the entry with a different one, reader
continuing, fetching the entry which is now a different
pointer than the pointer for which VALID was meant.

The biggest consequence of this is that we may see a UAF
since net_shaper_rollback() assumed that entries without
VALID can be freed without observing RCU.

Looks like the XArray marks are buying us nothing at this
point. Let's convert the code to an explicit valid field.
The smp_load_acquire() / smp_store_release() barriers are
marginally cleaner.

The Linux kernel CVE team has assigned CVE-2026-64027 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.13 with commit 93954b40f6a4fc43226c01a15b02732f884500f1 and fixed in 6.18.34 with commit 2417df5e7bb4184b9d3a2988036bf2c46e594545
	Issue introduced in 6.13 with commit 93954b40f6a4fc43226c01a15b02732f884500f1 and fixed in 7.0.11 with commit 96ea960dd40fd55302e0fd755176f26a95e6a50c
	Issue introduced in 6.13 with commit 93954b40f6a4fc43226c01a15b02732f884500f1 and fixed in 7.1 with commit b8d7519352ba8c6df83259295d4a3bad093cae90

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64027
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/net_shaper.h
	net/shaper/shaper.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/2417df5e7bb4184b9d3a2988036bf2c46e594545
	https://git.kernel.org/stable/c/96ea960dd40fd55302e0fd755176f26a95e6a50c
	https://git.kernel.org/stable/c/b8d7519352ba8c6df83259295d4a3bad093cae90