PT-2026-61440 · Linux · Linux

CVE-2026-64123 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

net: hsr: defer node table free until after RCU readers

HSR node-list and node-status generic-netlink operations run under rcu read lock(). They walk hsr->node db through hsr get next node() and hsr get node data(), but RTM DELLINK teardown removes the same node table with plain list del() and frees each node immediately.

That lets a generic-netlink reader hold a struct hsr node pointer across hsr dellink(). In a KASAN build, widening the reader window after hsr get next node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress A; the freeing stack is hsr del nodes() from hsr dellink().

Use list del rcu() and defer the free through the existing hsr free node rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list del rcu() and call rcu().

Correção

Identificadores relacionados

CVE-2026-64123

Produtos afetados

Linux

Referências · 8

• https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb · Nota
• https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c · Nota
• https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64123 · Nota de Segurança
• https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde · Nota
• https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce · Nota
• https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9 · Nota
• https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b · Nota