CVE-2026-64123
Received Received - Intake

Use-After-Free in Linux Kernel HSR Implementation

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress_A; the freeing stack is hsr_del_nodes() from hsr_dellink(). Use list_del_rcu() and defer the free through the existing hsr_free_node_rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list_del_rcu() and call_rcu().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64123
EUVD
EUVD-2026-45808

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the HSR (High-availability Seamless Redundancy) protocol. It involves a use-after-free issue where RCU readers accessing node data can hold pointers to memory that is freed prematurely during teardown. The fix uses RCU-safe list deletion and defers freeing memory until after readers finish.

Detection Guidance

This vulnerability is specific to the Linux kernel's HSR (High-availability Seamless Redundancy) implementation. Detection requires checking kernel logs for slab-use-after-free errors related to HSR node operations. Use dmesg or journalctl to search for kernel messages indicating use-after-free in hsr_get_next_node or hsr_get_node_data. Commands: dmesg | grep -i 'hsr' or journalctl -k | grep -i 'hsr'.

Impact Analysis

If exploited, this could lead to system crashes, memory corruption, or privilege escalation. Attackers might trigger a slab-use-after-free, causing instability or arbitrary code execution in the kernel.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue in the HSR networking subsystem that could lead to slab-use-after-free errors under specific conditions. Compliance implications would depend on how the affected system is used in a broader context, not the vulnerability itself.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this issue is resolved. Check your distribution's security advisories for kernel updates addressing CVE-2026-64123. If updating is not immediately possible, disable HSR functionality if unused, as this vulnerability affects HSR node operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64123. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart