CVE-2026-100071 (GCVE-0-2026-100071)
Vulnerability from cvelistv5
Published
2026-09-25 13:06
Modified
2026-10-19 08:43
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and interlink adds). RX handlers run in softirq regardless of the master's state, so frames received in that window can learn dynamic nodes into node_db, and the error unwind never releases them. Free both owned dynamic databases in the unwind, mirroring hsr_dellink(). proxy_node_db is provably empty on every current error exit (only interlink RX feeds it, and the interlink add is the last failable step) and is freed for symmetry. The order is safe: hsr_del_port() unregisters each RX handler with synchronize_net() before hsr_del_nodes() runs, which removes remaining entries with list_del_rcu() and defers their release with call_rcu() for readers already under RCU.
References
Impacted products
Vendor Product Version
Linux Linux Version: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8
Version: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8
Version: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8
Version: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8
Version: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8
Version: 81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e691eee886871b933d772ffc76d66c80b4c0a25e",
              "status": "affected",
              "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
              "versionType": "git"
            },
            {
              "lessThan": "0a340ffd96943a49a78e367efac9517ca767d99b",
              "status": "affected",
              "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
              "versionType": "git"
            },
            {
              "lessThan": "f7289e3492f2694dccd3d79287e0e31879b58650",
              "status": "affected",
              "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
              "versionType": "git"
            },
            {
              "lessThan": "65702339b3e9fd792f65d4b740928798194d86ce",
              "status": "affected",
              "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
              "versionType": "git"
            },
            {
              "lessThan": "49b01f2939abc676a6f9a118f07a10110ee5f683",
              "status": "affected",
              "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
              "versionType": "git"
            },
            {
              "lessThan": "7f16289b91eb316f170a6bd22d32e6c632f6a5b6",
              "status": "affected",
              "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_device.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.17"
            },
            {
              "lessThan": "3.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster\u0027s state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:43:03.400Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650"
        },
        {
          "url": "https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683"
        },
        {
          "url": "https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6"
        }
      ],
      "title": "net: hsr: free learned nodes on device setup failure",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-100071",
    "datePublished": "2026-09-25T13:06:44.956Z",
    "dateReserved": "2026-09-25T10:25:14.456Z",
    "dateUpdated": "2026-10-19T08:43:03.400Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.