CVE-2026-64000: Linux Kernel HSR Buffer Overflow Flaw

CVE-2026-64000 Overview

CVE-2026-64000 is a vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) networking subsystem. The flaw exists in the supervision frame handling code path, where the kernel fails to fully linearize the Type-Length-Value (TLV) header before accessing it. A truncated frame can trigger an out-of-bounds read [CWE-125] because pskb_may_pull() was not called with the full sizeof(struct hsr_sup_tlv) length. The upstream fix adds the missing size argument to ensure the entire TLV header resides in the linear portion of the socket buffer prior to dereference.

Critical Impact
Remote attackers on adjacent HSR-enabled networks can send crafted supervision frames to trigger out-of-bounds memory access in the Linux kernel, potentially causing denial of service or memory disclosure.

Affected Products

Linux kernel (HSR networking subsystem)
Distributions shipping vulnerable kernel versions prior to the referenced stable commits
Systems with HSR interfaces configured for redundant Ethernet networks

Discovery Timeline

2026-07-19 - CVE-2026-64000 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64000

Vulnerability Analysis

The vulnerability resides in the HSR protocol implementation within the Linux kernel networking stack. HSR is defined by IEC 62439-3 and provides seamless failover for industrial Ethernet networks. Supervision frames are periodically exchanged between HSR nodes to advertise presence and detect link failures.

When the kernel processes an incoming supervision frame, it parses a sequence of TLV structures described by struct hsr_sup_tlv. Before the fix, calls to pskb_may_pull() did not include sizeof(struct hsr_sup_tlv) in the required length, meaning the kernel could dereference memory beyond the linear portion of the skb when a frame was truncated or crafted to be shorter than expected.

Root Cause

The root cause is insufficient bounds checking on network-supplied data. The pskb_may_pull() helper ensures a specified number of bytes are present in the contiguous portion of the socket buffer. Omitting the TLV header size from the length calculation allowed the parser to read past the validated region, resulting in an out-of-bounds access [CWE-125].

Attack Vector

An attacker with the ability to transmit Ethernet frames on an HSR-enabled network segment can send a malformed supervision frame containing a truncated TLV. The kernel parser then reads beyond the frame boundary while attempting to interpret the TLV header. Depending on adjacent memory contents and kernel configuration, this can produce kernel panics, information disclosure, or exploitable memory corruption primitives.

The vulnerability manifests during supervision frame processing in the HSR receive path. See the referenced Kernel Git Commit 09a37dc and companion commits for the exact code changes that add the missing sizeof(struct hsr_sup_tlv) argument to pskb_may_pull() calls.

Detection Methods for CVE-2026-64000

Indicators of Compromise

Unexpected kernel oops or panic messages referencing hsr_ symbols in dmesg or /var/log/kern.log
KASAN reports indicating out-of-bounds reads within the HSR module on kernels built with memory sanitizers
Anomalous or malformed HSR supervision frames observed on packet captures from redundant Ethernet segments

Detection Strategies

Inspect running kernel versions across Linux fleets and compare against the fixed stable commits referenced by upstream
Monitor kernel crash telemetry for stack traces originating from HSR receive functions
Deploy network sensors on HSR VLANs to flag supervision frames with lengths inconsistent with the expected TLV structure

Monitoring Recommendations

Enable kernel crash reporting (kdump, systemd-coredump) on hosts with HSR interfaces to capture faulting frames
Aggregate kernel logs into a centralized logging platform and alert on repeated HSR-related oops signatures
Track HSR interface counters (ip -s link show) for spikes in dropped or malformed frames

How to Mitigate CVE-2026-64000

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits 09a37dc, 71c986c, 78607a6, a4b64f3, f229426, and fbd0662
Update to a distribution kernel that includes the fix on all systems running HSR interfaces
Where patching is not immediately possible, restrict physical and logical access to HSR network segments

Patch Information

The fix adds sizeof(struct hsr_sup_tlv) to the length argument of pskb_may_pull() calls in the supervision frame handler, ensuring the TLV header is fully linearized before access. Patches are available in the mainline and stable Linux kernel trees via the following references: Kernel Git Commit 09a37dc, Kernel Git Commit 71c986c, Kernel Git Commit 78607a6, Kernel Git Commit a4b64f3, Kernel Git Commit f229426, and Kernel Git Commit fbd0662.

Workarounds

Unload the hsr kernel module on systems that do not require HSR functionality using modprobe -r hsr
Blacklist the hsr module to prevent automatic loading on boot where the feature is unused
Segment HSR networks from untrusted hosts and enforce strict Layer 2 access controls on switch ports

bash

# Configuration example
# Verify whether the HSR module is loaded
lsmod | grep hsr

# Unload the module if HSR is not in use
sudo modprobe -r hsr

# Prevent automatic loading on boot
echo "blacklist hsr" | sudo tee /etc/modprobe.d/blacklist-hsr.conf

# Verify installed kernel version after patching
uname -r