SECUFOCUSNOW
Home›CVE index›CVE-2026-64123
Review reviewHigh

CVE-2026-64123

Linux

In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-f...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-f...

Affected product and versions

Product
Linux
Affected versions
>= b9a1e627405d68d475a3c1f35e685ccfb5bbe668 < 0ea70fb46940620848c08d9d399455c9e82fecdb, >= b9a1e627405d68d475a3c1f35e685ccfb5bbe668 < 8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b, >= b9a1e627405d68d475a3c1f35e685ccfb5bbe668 < c5580114e0492bcd2e0a37613ed4c311e3fa3d4d, >= b9a1e627405d68d475a3c1f35e685ccfb5bbe668 < 7713f4aafb577ff49fa67f0488d9c7dddc64d6ce, >= b9a1e627405d68d475a3c1f35e685ccfb5bbe668 < 6324423a8e6591f41a16c09a8f9a84e554ac147c, >= b9a1e627405d68d475a3c1f35e685ccfb5bbe668 < 8c3af18bb0d7c921a5219194037509463eb2ffde, >= b9a1e627405d68d475a3c1f35e685ccfb5bbe668 < aaec7096f9961eb223b5b149abe9495525c205d9, >= 08523d5a2f4a9e4202e00d282c164d453cabe2d2, >= 5.2.12 < 5.3, >= 5.3
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available