net: hsr: defer node table free until after RCU readers

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2026-64123
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-07-19 16:17:53 UTC
Updated2026-07-19 16:17:53 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress_A; the freeing stack is hsr_del_nodes() from hsr_dellink(). Use list_del_rcu() and defer the free through the existing hsr_free_node_rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list_del_rcu() and call_rcu().

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected b9a1e627405d68d475a3c1f35e685ccfb5bbe668 0ea70fb46940620848c08d9d399455c9e82fecdb git Not specified
CNA Linux Linux affected b9a1e627405d68d475a3c1f35e685ccfb5bbe668 8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b git Not specified
CNA Linux Linux affected b9a1e627405d68d475a3c1f35e685ccfb5bbe668 c5580114e0492bcd2e0a37613ed4c311e3fa3d4d git Not specified
CNA Linux Linux affected b9a1e627405d68d475a3c1f35e685ccfb5bbe668 7713f4aafb577ff49fa67f0488d9c7dddc64d6ce git Not specified
CNA Linux Linux affected b9a1e627405d68d475a3c1f35e685ccfb5bbe668 6324423a8e6591f41a16c09a8f9a84e554ac147c git Not specified
CNA Linux Linux affected b9a1e627405d68d475a3c1f35e685ccfb5bbe668 8c3af18bb0d7c921a5219194037509463eb2ffde git Not specified
CNA Linux Linux affected b9a1e627405d68d475a3c1f35e685ccfb5bbe668 aaec7096f9961eb223b5b149abe9495525c205d9 git Not specified
CNA Linux Linux affected 08523d5a2f4a9e4202e00d282c164d453cabe2d2 git Not specified
CNA Linux Linux affected 5.2.12 5.3 semver Not specified
CNA Linux Linux affected 5.3 Not specified
CNA Linux Linux unaffected 5.3 semver Not specified
CNA Linux Linux unaffected 5.10.259 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.210 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.176 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.143 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.93 6.12.* semver Not specified
CNA Linux Linux unaffected 7.0.11 7.0.* semver Not specified
CNA Linux Linux unaffected 7.1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report