CVE-2026-64123: Linux Kernel HSR Use-After-Free Flaw

CVE-2026-64123 Overview

CVE-2026-64123 is a use-after-free vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) networking subsystem. The flaw resides in the node table teardown path invoked during RTM_DELLINK. Generic-netlink readers walk hsr->node_db under rcu_read_lock() via hsr_get_next_node() and hsr_get_node_data(), but the teardown code path uses plain list_del() and frees each struct hsr_node immediately. A concurrent reader can retain a pointer to a freed node and dereference fields such as node->macaddress_A, producing a slab-use-after-free reproducible under Kernel Address Sanitizer (KASAN).

Critical Impact
A local, low-privileged user can trigger memory corruption in the kernel by racing HSR netlink queries against link deletion, enabling denial of service or potential local privilege escalation.

Affected Products

Linux kernel builds compiled with CONFIG_HSR enabled
Systems exposing HSR generic-netlink operations to local users
Kernel branches prior to the fixes referenced in the stable git commits listed below

Discovery Timeline

2026-07-19 - CVE-2026-64123 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64123

Vulnerability Analysis

HSR maintains a per-interface node database (hsr->node_db) tracking peer MAC addresses and sequence numbers. Generic-netlink handlers such as node-list and node-status enumerate this database while holding only rcu_read_lock(). The teardown path executed during interface deletion, hsr_del_nodes() invoked from hsr_dellink(), removes entries with list_del() and frees each hsr_node synchronously.

The two paths operate under incompatible lifetime rules. RCU readers assume that objects reachable through the list remain valid for the duration of the read-side critical section. The synchronous free breaks that assumption, allowing the reader to access memory that has been returned to the slab allocator. KASAN detects the resulting use-after-free when the reader copies node->macaddress_A.

Root Cause

The root cause is a mismatch between the RCU read-side protocol used by the netlink readers and the non-RCU deletion protocol used by teardown. Other HSR paths, notably the prune logic, already use list_del_rcu() followed by call_rcu() with the hsr_free_node_rcu() callback. The dellink path did not follow this convention, leaving a window where freed memory remained referenced by concurrent readers.

Attack Vector

Exploitation requires local access with the ability to issue generic-netlink queries against an HSR interface while it is being torn down. An attacker races an RTM_DELLINK request against repeated node-list or node-status queries. When the timing aligns, the reader dereferences a freed hsr_node, producing memory corruption. The published CVSS vector indicates a local attack vector with low privileges required and no user interaction.

The upstream fix replaces list_del() with list_del_rcu() and defers freeing through the existing hsr_free_node_rcu() RCU callback, aligning the teardown path with the pre-existing prune lifetime rules.

Detection Methods for CVE-2026-64123

Indicators of Compromise

KASAN reports referencing slab-use-after-free with call stacks including hsr_get_next_node, hsr_get_node_data, hsr_del_nodes, or hsr_dellink
Kernel oops or general protection fault entries in dmesg originating from the net/hsr module
Unexpected panics correlated with concurrent HSR netlink activity and interface teardown

Detection Strategies

Enable KASAN in test kernels to catch use-after-free access patterns in the HSR subsystem before production exposure
Audit kernel package versions against the fixed commits published on git.kernel.org to identify unpatched hosts
Monitor auditd for RTM_DELLINK operations on HSR interfaces performed by non-root users or in unexpected contexts

Monitoring Recommendations

Collect kernel ring buffer output centrally and alert on stack traces referencing hsr_del_nodes or hsr_free_node_rcu
Track loading of the hsr kernel module on hosts where HSR is not required, and remove it where unused
Correlate netlink socket activity with process identity to identify unprivileged users interacting with HSR interfaces

How to Mitigate CVE-2026-64123

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable commits 0ea70fb4, 6324423a, 7713f4aa, 8be6685c, 8c3af18b, aaec7096, and c5580114 through your distribution's update channel
Restrict local shell and container access to trusted users on systems that use HSR bonding for industrial or high-availability networking
Unload the hsr kernel module on hosts that do not require Seamless Redundancy functionality

Patch Information

The fix modifies the HSR dellink path to remove nodes with list_del_rcu() and defers memory reclamation via call_rcu() using the existing hsr_free_node_rcu() callback. See the upstream commits: Kernel Git Commit 0ea70fb4, Kernel Git Commit 6324423a, Kernel Git Commit 7713f4aa, Kernel Git Commit 8be6685c, Kernel Git Commit 8c3af18b, Kernel Git Commit aaec7096, and Kernel Git Commit c5580114.

Workarounds

Blacklist the hsr module on systems that do not require HSR or PRP redundancy protocols
Limit CAP_NET_ADMIN and generic-netlink access to trusted service accounts to reduce the local attack surface
Where HSR is required, avoid teardown of HSR interfaces while monitoring tools are actively enumerating node tables

bash

# Blacklist the HSR module on hosts that do not require it
echo 'blacklist hsr' | sudo tee /etc/modprobe.d/blacklist-hsr.conf
sudo modprobe -r hsr 2>/dev/null || true

# Verify the module is no longer loaded
lsmod | grep -E '^hsr\s' || echo 'hsr not loaded'