CVE-2026-100071
Received Received - Intake

HSR Memory Leak in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and interlink adds). RX handlers run in softirq regardless of the master's state, so frames received in that window can learn dynamic nodes into node_db, and the error unwind never releases them. Free both owned dynamic databases in the unwind, mirroring hsr_dellink(). proxy_node_db is provably empty on every current error exit (only interlink RX feeds it, and the interlink add is the last failable step) and is freed for symmetry. The order is safe: hsr_del_port() unregisters each RX handler with synchronize_net() before hsr_del_nodes() runs, which removes remaining entries with list_del_rcu() and defers their release with call_rcu() for readers already under RCU.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-100071
EUVD
EUVD-2026-87068

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a failure to free dynamically learned nodes in the HSR (High-availability Seamless Redundancy) protocol when device setup fails. If hsr_dev_finalize() fails after a lower-device RX handler is registered, frames received during this window can populate the node database. The error unwind path does not release these nodes, potentially causing memory leaks.

Detection Guidance

This vulnerability is specific to the Linux kernel's HSR (High-availability Seamless Redundancy) implementation. Detection requires checking kernel logs for HSR-related errors or failures during device setup. Monitor logs for messages indicating hsr_dev_finalize() failures or RX handler registration issues.

Impact Analysis

This vulnerability may lead to memory leaks in systems using the HSR protocol, which could degrade performance or cause system instability over time. It primarily affects Linux systems configured with HSR for network redundancy.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If using a vulnerable kernel version, avoid adding HSR slave devices in a sequence that could trigger the failure condition. Monitor kernel logs for HSR-related errors and update to a patched kernel version as soon as possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100071. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart