Executive brief
A vulnerability was identified in the Linux kernel's High-availability Seamless Redundancy (HSR) networking component. This component is used to ensure reliable communication in industrial and critical infrastructure networks. An attacker could potentially exploit this flaw to cause a system crash or gain unauthorized access to memory by sending specially crafted network frames.
Technical details
An out-of-bounds access vulnerability exists in net/hsr/hsr_forward.c within the Linux kernel. The issue stems from insufficient validation of Type-Length-Value (TLV) headers in HSR supervision frames. Specifically, the code failed to ensure the entire TLV header was linearized in the socket buffer before access. By sending a truncated or malformed frame, an attacker could trigger an OOB read. The fix involves updating pskb_may_pull() calls to include the size of the hsr_sup_tlv structure, ensuring proper bounds checking. Patches are available in various stable kernel branches including 6.1.176, 6.6.143, 6.12.93, 6.18.35, and 7.0.12.
Affected products
- Linux Linux 5.16 to 7.0.11
Timeline
- 2026-05-23: other: Vulnerability fixed in upstream kernel code
- 2026-07-19: advisory: CVE-2026-64000 published
References
- https://git.kernel.org/stable/c/09a37dca090c55ffb1a33f52d8667f1c2367ef48
- https://git.kernel.org/stable/c/71c986c0ba45b7dc574fae27c83e7b6671556f37
- https://git.kernel.org/stable/c/78607a6854a22a2502f68092202e75a39af4865d
- https://git.kernel.org/stable/c/a4b64f3e9c7b8259f7dd251a0313420ba7c01852
- https://git.kernel.org/stable/c/f229426072fc865654a60978bb7fda790a051ff3
- https://git.kernel.org/stable/c/fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7