CVE-2026-64000

Analyzed Analyzed - Analysis Complete

HSR Supervision Frame OOB Access in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-10-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-08

NVD

CVE-2026-64000

EUVD

EUVD-2026-45573

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-125	The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where truncated network frames in the HSR (High-availability Seamless Redundancy) protocol could cause out-of-bounds memory access. The issue occurs when handling supervision frames without proper linearization checks.

Detection Guidance

This vulnerability affects the Linux kernel's HSR (High-availability Seamless Redundancy) implementation. Detection requires checking kernel versions and HSR module usage. Commands: uname -a to check kernel version, lsmod | grep hsr to verify HSR module loading, and dmesg | grep hsr for any related errors.

Impact Analysis

An attacker could exploit this to crash the system or potentially execute arbitrary code with kernel privileges. Systems using HSR for network redundancy may be affected.

Compliance Impact

This vulnerability is a Linux kernel issue involving potential out-of-bounds (OOB) access in network frame handling. It does not directly relate to data privacy, storage, or processing requirements covered by GDPR or HIPAA. Compliance impact would depend on whether the affected system processes or transmits regulated data, but the vulnerability itself is unrelated to regulatory controls.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64000. If HSR is not in use, unload the module with rmmod hsr. Monitor kernel security advisories for updates.

Hi! I’m here to help you understand CVE-2026-64000. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70