Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
Linux Kernel: HSR Node Table Freeing Issue
published 3 months ago
Summary
A bug in the Linux kernel's HSR (High-Speed Router) module can cause data to be accessed after it has been freed, potentially leading to system instability. This issue affects systems running Linux with the HSR module enabled. To resolve this issue, system administrators should apply the latest Linux kernel updates to ensure the HSR node table is properly freed.
What to do
- Update linux kernel to version 7.0.11.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Linux | linux | kernel |
>= 6.13.0, < 7.0.11 Fix: upgrade to 7.0.11
|
Original advisory text
net: hsr: defer node table free until after RCU readers
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: defer node table free until after RCU readers
HSR node-list and node-status generic-netlink operations run under
rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and
hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table
with plain list_del() and frees each node immediately.
That lets a generic-netlink reader hold a struct hsr_node pointer across
hsr_dellink(). In a KASAN build, widening the reader window after
hsr_get_next_node() obtains the node reproduces a slab-use-after-free
when the reader copies node->macaddress_A; the freeing stack is
hsr_del_nodes() from hsr_dellink().
Use list_del_rcu() and defer the free through the existing
hsr_free_node_rcu() callback. This matches the lifetime rule used by the
HSR prune paths, which already delete nodes with list_del_rcu() and
call_rcu().
net: hsr: defer node table free until after RCU readers
HSR node-list and node-status generic-netlink operations run under
rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and
hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table
with plain list_del() and frees each node immediately.
That lets a generic-netlink reader hold a struct hsr_node pointer across
hsr_dellink(). In a KASAN build, widening the reader window after
hsr_get_next_node() obtains the node reproduces a slab-use-after-free
when the reader copies node->macaddress_A; the freeing stack is
hsr_del_nodes() from hsr_dellink().
Use list_del_rcu() and defer the free through the existing
hsr_free_node_rcu() callback. This matches the lifetime rule used by the
HSR prune paths, which already delete nodes with list_del_rcu() and
call_rcu().
References
- https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb URL
- https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c URL
- https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce URL
- https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b URL
- https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde URL
- https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9 URL
- https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64123... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-64123 Vendor Advisory
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Timeline
Published19 Jul 2026
Updated1 Aug 2026
First seen1 Aug 2026
Track software like this
Free during beta