CVE-2026-64123: net: hsr: defer node table free until after RCU readers
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: defer node table free until after RCU readers
HSR node-list and node-status generic-netlink operations run under rcureadlock(). They walk hsr->nodedb through hsrgetnextnode() and hsrgetnodedata(), but RTMDELLINK teardown removes the same node table with plain listdel() and frees each node immediately.
That lets a generic-netlink reader hold a struct hsrnode pointer across hsrdellink(). In a KASAN build, widening the reader window after hsrgetnextnode() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddressA; the freeing stack is hsrdelnodes() from hsrdellink().
Use listdelrcu() and defer the free through the existing hsrfreenodercu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with listdelrcu() and callrcu().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the HSR node deletion paths, including hsr_dellink(), use list_del_rcu() and defer node freeing through call_rcu() with the existing hsr_free_node_rcu() callback.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64123?
CVE-2026-64123 has a high severity score of 7.8.
How do I fix CVE-2026-64123?
To fix CVE-2026-64123, update to the latest version of the Linux Kernel where the vulnerability is resolved.
What type of vulnerability is CVE-2026-64123?
CVE-2026-64123 is classified as a Use After Free vulnerability.
Which software is affected by CVE-2026-64123?
CVE-2026-64123 affects the Linux Kernel specifically in the net: hsr component.
When was CVE-2026-64123 published?
CVE-2026-64123 was published on July 19, 2026.