Executive brief
A vulnerability was identified in the Linux kernel's High-availability Seamless Redundancy (HSR) networking protocol. A local attacker could potentially cause a system crash or instability (denial of service) by triggering a race condition when network interfaces are being removed while node information is being read. This issue affects systems using HSR or Parallel Redundancy Protocol (PRP) for high-availability networking.
Technical details
A race condition exists in net/hsr/hsr_framereg.c due to improper synchronization between Generic Netlink readers and interface teardown. While node-list and node-status operations are protected by rcu_read_lock(), the hsr_dellink() function used plain list_del() and immediate kfree() to remove nodes from the node_db. This allows a reader to maintain a pointer to a struct hsr_node that is freed during teardown, resulting in a slab-use-after-free. The fix implements list_del_rcu() and defers memory reclamation using kfree_rcu() to ensure all RCU readers have finished before the memory is released.
Affected products
- Linux Linux Kernel 5.3 to 6.9.x
Timeline
- 2026-05-13: other: Patch submitted to mailing list
- 2026-06-19: patched: Commits merged into stable branches
- 2026-07-19: advisory: CVE published
References
- https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb
- https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c
- https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce
- https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b
- https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde
- https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9
- https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d