In the Linux kernel, the following vulnerability has been resolved:

net: hsr: defer node table free until after RCU readers

HSR node-list and node-status generic-netlink operations run under rcureadlock(). They walk hsr->nodedb through hsrgetnextnode() and hsrgetnodedata(), but RTMDELLINK teardown removes the same node table with plain listdel() and frees each node immediately.

That lets a generic-netlink reader hold a struct hsrnode pointer across hsrdellink(). In a KASAN build, widening the reader window after hsrgetnextnode() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddressA; the freeing stack is hsrdelnodes() from hsrdellink().

Use listdelrcu() and defer the free through the existing hsrfreenodercu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with listdelrcu() and callrcu().