High 7.8Published Jul 19, 2026

CVE-2026-64123net: hsr: defer node table free until after RCU readers

Updated under an hour ago (Oct 27, 2026, 9:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress_A; the freeing stack is hsr_del_nodes() from hsr_dellink(). Use list_del_rcu() and defer the free through the existing hsr_free_node_rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list_del_rcu() and call_rcu().

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before 0ea70fb46940620848c08d9d399455c9e82fecdb; from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before 8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b; from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before c5580114e0492bcd2e0a37613ed4c311e3fa3d4d; from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before 7713f4aafb577ff49fa67f0488d9c7dddc64d6ce; from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before 6324423a8e6591f41a16c09a8f9a84e554ac147c; from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before 48d09dea506de667eb55f939bf98eec721effbdb; from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before 8c3af18bb0d7c921a5219194037509463eb2ffde; from b9a1e627405d68d475a3c1f35e685ccfb5bbe668 before aaec7096f9961eb223b5b149abe9495525c205d9; and 2 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.2.12 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.143; from 6.7 before 6.12.93; from 6.13 before 7.0.11; 7.1; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb	patch
https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b	patch
https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d	patch
https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce	patch
https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c	patch
https://git.kernel.org/stable/c/48d09dea506de667eb55f939bf98eec721effbdb
https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde	patch
https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.