PT-2026-61440 · Linux · Linux

CVE-2026-64123 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

net: hsr: defer node table free until after RCU readers

HSR node-list and node-status generic-netlink operations run under rcu read lock(). They walk hsr->node db through hsr get next node() and hsr get node data(), but RTM DELLINK teardown removes the same node table with plain list del() and frees each node immediately.

That lets a generic-netlink reader hold a struct hsr node pointer across hsr dellink(). In a KASAN build, widening the reader window after hsr get next node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress A; the freeing stack is hsr del nodes() from hsr dellink().

Use list del rcu() and defer the free through the existing hsr free node rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list del rcu() and call rcu().

Fix

Related Identifiers

CVE-2026-64123

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-64123 · Security Note
• https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb · Note
• https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c · Note
• https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d · Note
• https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde · Note
• https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce · Note
• https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9 · Note
• https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b · Note