CVE-2026-64000
Received Received - Intake

HSR Supervision Frame OOB Access in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64000
EUVD
EUVD-2026-45573

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux linux_kernel *
linux kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where truncated network frames in the HSR (High-availability Seamless Redundancy) protocol could cause out-of-bounds memory access. The issue occurs when handling supervision frames without proper linearization checks.

Detection Guidance

This vulnerability affects the Linux kernel's HSR (High-availability Seamless Redundancy) implementation. Detection requires checking kernel versions and HSR module usage. Commands: uname -a to check kernel version, lsmod | grep hsr to verify HSR module loading, and dmesg | grep hsr for any related errors.

Impact Analysis

An attacker could exploit this to crash the system or potentially execute arbitrary code with kernel privileges. Systems using HSR for network redundancy may be affected.

Compliance Impact

This vulnerability is a Linux kernel issue involving potential out-of-bounds (OOB) access in network frame handling. It does not directly relate to data privacy, storage, or processing requirements covered by GDPR or HIPAA. Compliance impact would depend on whether the affected system processes or transmits regulated data, but the vulnerability itself is unrelated to regulatory controls.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-64000. If HSR is not in use, unload the module with rmmod hsr. Monitor kernel security advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64000. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart