Critical 9.8Published Jul 19, 2026

CVE-2026-64000net: hsr: fix potential OOB access in supervision frame handling

Updated under an hour ago (Oct 27, 2026, 10:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-125
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from eafaa88b3eb7f28aecb222281655473431d3ef2e before 09a37dca090c55ffb1a33f52d8667f1c2367ef48; from eafaa88b3eb7f28aecb222281655473431d3ef2e before a4b64f3e9c7b8259f7dd251a0313420ba7c01852; from eafaa88b3eb7f28aecb222281655473431d3ef2e before 71c986c0ba45b7dc574fae27c83e7b6671556f37; from eafaa88b3eb7f28aecb222281655473431d3ef2e before fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7; from eafaa88b3eb7f28aecb222281655473431d3ef2e before 78607a6854a22a2502f68092202e75a39af4865d; from eafaa88b3eb7f28aecb222281655473431d3ef2e before f229426072fc865654a60978bb7fda790a051ff3	CNA record
linux linux_kernel linux:linux_kernel	from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 6.18.35; from 6.19 before 7.0.12; 7.1; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/09a37dca090c55ffb1a33f52d8667f1c2367ef48	patch
https://git.kernel.org/stable/c/a4b64f3e9c7b8259f7dd251a0313420ba7c01852	patch
https://git.kernel.org/stable/c/71c986c0ba45b7dc574fae27c83e7b6671556f37	patch
https://git.kernel.org/stable/c/fbd0662f9c9a66e8cc3df3099cca8ed6d3837cc7	patch
https://git.kernel.org/stable/c/78607a6854a22a2502f68092202e75a39af4865d	patch
https://git.kernel.org/stable/c/f229426072fc865654a60978bb7fda790a051ff3	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.