Answer in brief
CVE-2026-64123 records a High severity (CVSS 7.8) vulnerability in net: hsr: defer node table free until after RCU readers. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <0ea70fb46940620848c08d9d399455c9e82fecdb || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <c5580114e0492bcd2e0a37613ed4c311e3fa3d4d || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <7713f4aafb577ff49fa67f0488d9c7dddc64d6ce || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <6324423a8e6591f41a16c09a8f9a84e554ac147c || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <8c3af18bb0d7c921a5219194037509463eb2ffde || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <aaec7096f9961eb223b5b149abe9495525c205d9 || 08523d5a2f4a9e4202e00d282c164d453cabe2d2 || >=5.2.12 <5.3 | 0ea70fb46940620848c08d9d399455c9e82fecdb, 8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b, c5580114e0492bcd2e0a37613ed4c311e3fa3d4d, 7713f4aafb577ff49fa67f0488d9c7dddc64d6ce, 6324423a8e6591f41a16c09a8f9a84e554ac147c, 8c3af18bb0d7c921a5219194037509463eb2ffde, aaec7096f9961eb223b5b149abe9495525c205d9, 5.3 |
| Linux/Linuxgeneric | 5.3 | Not reported |
| Linux/Linuxgeneric | >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <0ea70fb46940620848c08d9d399455c9e82fecdb || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <c5580114e0492bcd2e0a37613ed4c311e3fa3d4d || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <7713f4aafb577ff49fa67f0488d9c7dddc64d6ce || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <6324423a8e6591f41a16c09a8f9a84e554ac147c || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <48d09dea506de667eb55f939bf98eec721effbdb || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <8c3af18bb0d7c921a5219194037509463eb2ffde || >=b9a1e627405d68d475a3c1f35e685ccfb5bbe668 <aaec7096f9961eb223b5b149abe9495525c205d9 || 08523d5a2f4a9e4202e00d282c164d453cabe2d2 || >=5.2.12 <5.3 | 0ea70fb46940620848c08d9d399455c9e82fecdb, 8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b, c5580114e0492bcd2e0a37613ed4c311e3fa3d4d, 7713f4aafb577ff49fa67f0488d9c7dddc64d6ce, 6324423a8e6591f41a16c09a8f9a84e554ac147c, 48d09dea506de667eb55f939bf98eec721effbdb, 8c3af18bb0d7c921a5219194037509463eb2ffde, aaec7096f9961eb223b5b149abe9495525c205d9, 5.3 |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress_A; the freeing stack is hsr_del_nodes() from hsr_dellink(). Use list_del_rcu() and defer the free through the existing hsr_free_node_rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list_del_rcu() and call_rcu().
Quoted source text, attributed separately from HOL analysis.