CVE-2026-64000: net: hsr: fix potential OOB access in supervision frame handling
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: fix potential OOB access in supervision frame handling
Ensure the entire TLV header is linearized before access by adding sizeof(struct hsrsuptlv) to the pskbmaypull() calls. Without this, a truncated frame could cause an out-of-bounds access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Ensure the entire TLV header is linearized before access by adding the TLV header size (sizeof(struct hsr_sup_tlv)) to the pskb_may_pull() calls during supervision frame handling in net/hsr.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64000?
CVE-2026-64000 has a severity rating of critical with a score of 9.8.
How do I fix CVE-2026-64000?
To fix CVE-2026-64000, you should update to the patched version of the Linux kernel that addresses the out-of-bounds access in supervision frame handling.
What type of access does CVE-2026-64000 affect?
CVE-2026-64000 affects out-of-bounds (OOB) access in the handling of supervision frames within the Linux kernel.
Which software is impacted by CVE-2026-64000?
CVE-2026-64000 impacts the Linux kernel, specifically the networking component related to HSR (High-availability Seamless Redundancy).
Is there an exploit for CVE-2026-64000?
While no specific exploit has been publicly disclosed for CVE-2026-64000, its critical severity suggests it could be exploited under the right conditions.