{"api_version":"1","generated_at":"2026-09-26T06:40:05+00:00","cve":"CVE-2026-100071","urls":{"html":"https://cve.report/CVE-2026-100071","api":"https://cve.report/api/cve/CVE-2026-100071.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-100071","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-100071"},"summary":{"title":"net: hsr: free learned nodes on device setup failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster's state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 14:17:13","updated_at":"2026-09-25 14:17:13"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce","name":"https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650","name":"https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b","name":"https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6","name":"https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683","name":"https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e","name":"https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-100071","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100071","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 e691eee886871b933d772ffc76d66c80b4c0a25e git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 0a340ffd96943a49a78e367efac9517ca767d99b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 f7289e3492f2694dccd3d79287e0e31879b58650 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 65702339b3e9fd792f65d4b740928798194d86ce git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 49b01f2939abc676a6f9a118f07a10110ee5f683 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8 7f16289b91eb316f170a6bd22d32e6c632f6a5b6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 3.17","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 3.17 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.188 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.157 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.110 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.52 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/hsr/hsr_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e691eee886871b933d772ffc76d66c80b4c0a25e","status":"affected","version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","versionType":"git"},{"lessThan":"0a340ffd96943a49a78e367efac9517ca767d99b","status":"affected","version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","versionType":"git"},{"lessThan":"f7289e3492f2694dccd3d79287e0e31879b58650","status":"affected","version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","versionType":"git"},{"lessThan":"65702339b3e9fd792f65d4b740928798194d86ce","status":"affected","version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","versionType":"git"},{"lessThan":"49b01f2939abc676a6f9a118f07a10110ee5f683","status":"affected","version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","versionType":"git"},{"lessThan":"7f16289b91eb316f170a6bd22d32e6c632f6a5b6","status":"affected","version":"81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/hsr/hsr_device.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"3.17"},{"lessThan":"3.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.188","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.157","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.110","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.52","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.188","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.157","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.110","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.52","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"3.17","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"3.17","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster's state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."}],"providerMetadata":{"dateUpdated":"2026-09-25T13:06:44.956Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e"},{"url":"https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b"},{"url":"https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650"},{"url":"https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce"},{"url":"https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683"},{"url":"https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6"}],"title":"net: hsr: free learned nodes on device setup failure","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-100071","datePublished":"2026-09-25T13:06:44.956Z","dateReserved":"2026-09-25T10:25:14.456Z","dateUpdated":"2026-09-25T13:06:44.956Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 14:17:13","lastModifiedDate":"2026-09-25 14:17:13","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"100071","Ordinal":"1","Title":"net: hsr: free learned nodes on device setup failure","CVE":"CVE-2026-100071","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"100071","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster's state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU.","Type":"Description","Title":"net: hsr: free learned nodes on device setup failure"}]}}}