CVE-2026-64123

Analyzed Analyzed - Analysis Complete

Use-After-Free in Linux Kernel HSR Implementation

Publication date: 2026-07-19

Last updated on: 2026-08-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress_A; the freeing stack is hsr_del_nodes() from hsr_dellink(). Use list_del_rcu() and defer the free through the existing hsr_free_node_rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list_del_rcu() and call_rcu().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-13

Generated

2026-08-30

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64123

EUVD

EUVD-2026-45808

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	From 5.2.12 (inc) to 5.10.259 (exc)
linux	linux_kernel	From 6.13 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the HSR (High-availability Seamless Redundancy) protocol. It involves a use-after-free issue where RCU readers accessing node data can hold pointers to memory that is freed prematurely during teardown. The fix uses RCU-safe list deletion and defers freeing memory until after readers finish.

Detection Guidance

This vulnerability is specific to the Linux kernel's HSR (High-availability Seamless Redundancy) implementation. Detection requires checking kernel logs for slab-use-after-free errors related to HSR node operations. Use dmesg or journalctl to search for kernel messages indicating use-after-free in hsr_get_next_node or hsr_get_node_data. Commands: dmesg | grep -i 'hsr' or journalctl -k | grep -i 'hsr'.

Impact Analysis

If exploited, this could lead to system crashes, memory corruption, or privilege escalation. Attackers might trigger a slab-use-after-free, causing instability or arbitrary code execution in the kernel.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel memory management issue in the HSR networking subsystem that could lead to slab-use-after-free errors under specific conditions. Compliance implications would depend on how the affected system is used in a broader context, not the vulnerability itself.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version where this issue is resolved. Check your distribution's security advisories for kernel updates addressing CVE-2026-64123. If updating is not immediately possible, disable HSR functionality if unused, as this vulnerability affects HSR node operations.

Hi! I’m here to help you understand CVE-2026-64123. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70