CVE-2026-97419

Received Received - Intake

Netlink Notification Bypass in Linux HSR Kernel

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: hsr: broadcast netlink notifications in the device's net namespace The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net. Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter. This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privileged listener in init_net receives events from HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port ifindex (HSR_A_IFINDEX). Switch both callers to genlmsg_multicast_netns(). Other families with .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and handshake. hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the master port via hsr_port_get_hsr().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97419

EUVD

EUVD-2026-86032

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the HSR (High-availability Seamless Redundancy) generic netlink family. The issue is that broadcast netlink notifications are sent to the default network namespace (init_net) instead of the device's own network namespace. This happens because two async notifiers, hsr_nl_ringerror() and hsr_nl_nodedown(), use genlmsg_multicast() which only delivers to init_net. As a result, listeners in the device's namespace miss their own events, while privileged listeners in init_net receive events from devices in other namespaces.

Detection Guidance

This vulnerability involves HSR netlink notifications not respecting network namespaces. Detection requires checking HSR device configurations and kernel behavior. Inspect active HSR interfaces with ip link show type hsr. Verify if ring error or node down events are properly isolated per namespace. No direct commands detect this flaw but monitoring HSR device events across namespaces may reveal inconsistencies.

Impact Analysis

This vulnerability could lead to incorrect monitoring of HSR devices. Network administrators might not receive critical alerts like ring errors or node down events for devices in their own namespace. Additionally, sensitive information such as peer node MAC addresses and slave port details could be exposed to privileged listeners in init_net, potentially leading to unauthorized access or information leakage.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves network namespace handling in the Linux kernel's HSR protocol, which could impact network event visibility but does not relate to data protection or privacy requirements.

Mitigation Strategies

Apply kernel updates that include the fix for this HSR netlink namespace issue. The patch changes genlmsg_multicast() to genlmsg_multicast_netns() for HSR events. Until patched, avoid using HSR devices across multiple network namespaces to reduce exposure. Monitor vendor advisories for kernel updates addressing this CVE.

Hi! I’m here to help you understand CVE-2026-97419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70