CVE-2026-68301 Overview
CVE-2026-68301 is a memory leak vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) networking subsystem. The flaw resides in hsr_del_port(), which fails to remove VLAN IDs synced to slave devices during unregistration. When an HSR master interface is brought up, vlan_vid0_add() propagates VLAN 0 to slave devices A and B. If a slave is later unregistered while HSR is active, the VLAN refcount is not released, leaving vlan_info and vlan_vid_info structures allocated after device destruction.
Critical Impact
The unreleased VLAN metadata leaks kernel memory each time an HSR slave device is unregistered, gradually exhausting resources in long-running systems using HSR redundancy.
Affected Products
- Linux kernel builds with CONFIG_HSR enabled and VLAN filtering support
- Systems using HSR master interfaces with slave devices A and B
- Long-running deployments performing network namespace cleanup or interface teardown
Discovery Timeline
- 2026-08-10 - CVE-2026-68301 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68301
Vulnerability Analysis
The vulnerability affects the HSR driver in net/hsr/. HSR provides seamless failover by bonding two slave interfaces behind a single master. When the master transitions to the UP state, the kernel auto-adds VLAN 0 through vlan_vid0_add(). HSR then propagates VID 0 to each slave through hsr_ndo_vlan_rx_add_vid(), incrementing VLAN refcounts on both slave interfaces.
The teardown path is asymmetric. hsr_del_port() detaches slave ports during netns cleanup or interface destruction but does not invoke the corresponding VLAN removal logic. This asymmetry violates the invariant enforced by comparable bonding and team drivers, which call vlan_vids_del_by_dev() during slave removal.
Root Cause
The root cause is missing cleanup in hsr_del_port(). The function tears down the port linkage without calling vlan_vids_del_by_dev(port->dev, master->dev). Any VLAN IDs synced by hsr_ndo_vlan_rx_add_vid() remain associated with the slave. When the underlying net_device is freed, its vlan_info structure retains a refcount and is never released, producing a persistent kernel memory leak.
Attack Vector
Exploitation requires the ability to trigger HSR slave unregistration events. Local operations that repeatedly create and destroy network namespaces, or repeatedly bring HSR interfaces up and remove slaves, will accumulate leaked vlan_info allocations. See the upstream kernel patch f72c31a for the fix that adds the missing VLAN cleanup call.
Detection Methods for CVE-2026-68301
Indicators of Compromise
- Steady growth in kernel slab allocations for vlan_info and vlan_vid_info objects reported by /proc/slabinfo
- Increasing kernel memory consumption on hosts that repeatedly create and tear down HSR interfaces or network namespaces
- kmemleak reports referencing VLAN metadata allocations tied to HSR slave devices
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK in test environments and scan for leaks after HSR slave unregistration cycles
- Correlate netlink interface removal events with subsequent slab growth using kernel tracing tools such as bpftrace or perf
- Compare running kernel versions against the fixed commits listed in the stable tree references
Monitoring Recommendations
- Track long-term MemAvailable and slab usage trends on industrial and telecom hosts running HSR
- Alert on abnormal vlan_info slab growth relative to active interface counts
- Audit orchestration workflows that repeatedly recreate network namespaces containing HSR slaves
How to Mitigate CVE-2026-68301
Immediate Actions Required
- Update to a Linux kernel release that includes the HSR VLAN cleanup fix in hsr_del_port()
- Inventory hosts using HSR bonding to identify systems requiring priority patching
- Restart affected hosts after patching to reclaim memory already leaked by prior unregistration events
Patch Information
The fix adds vlan_vids_del_by_dev(port->dev, master->dev) to hsr_del_port() before unlinking slave A or slave B, mirroring the propagation logic in hsr_ndo_vlan_rx_add_vid() and hsr_ndo_vlan_rx_kill_vid(). Patches are available in the stable tree: 21d4840, ae995b8, b5ded44, dcf15ea, and f72c31a.
Workarounds
- Avoid repeated create and destroy cycles of HSR slave interfaces on unpatched kernels
- Schedule periodic reboots on unpatched hosts to reclaim leaked kernel memory
- Disable HSR on systems where redundancy is not required until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
