CVE-2026-100071

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-100071", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.456Z", "datePublished": "2026-09-25T13:06:44.956Z", "dateUpdated": "2026-10-19T08:43:03.400Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:43:03.400Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster's state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/hsr/hsr_device.c"], "versions": [{"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "lessThan": "e691eee886871b933d772ffc76d66c80b4c0a25e", "status": "affected", "versionType": "git"}, {"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "lessThan": "0a340ffd96943a49a78e367efac9517ca767d99b", "status": "affected", "versionType": "git"}, {"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "lessThan": "f7289e3492f2694dccd3d79287e0e31879b58650", "status": "affected", "versionType": "git"}, {"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "lessThan": "65702339b3e9fd792f65d4b740928798194d86ce", "status": "affected", "versionType": "git"}, {"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "lessThan": "49b01f2939abc676a6f9a118f07a10110ee5f683", "status": "affected", "versionType": "git"}, {"version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "lessThan": "7f16289b91eb316f170a6bd22d32e6c632f6a5b6", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/hsr/hsr_device.c"], "versions": [{"version": "3.17", "status": "affected"}, {"version": "0", "lessThan": "3.17", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.110", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.52", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.6", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.12.110"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "6.18.52"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.2.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e"}, {"url": "https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b"}, {"url": "https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650"}, {"url": "https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce"}, {"url": "https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683"}, {"url": "https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6"}], "title": "net: hsr: free learned nodes on device setup failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/hsr/hsr_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e691eee886871b933d772ffc76d66c80b4c0a25e", "status": "affected", "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "versionType": "git"}, {"lessThan": "0a340ffd96943a49a78e367efac9517ca767d99b", "status": "affected", "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "versionType": "git"}, {"lessThan": "f7289e3492f2694dccd3d79287e0e31879b58650", "status": "affected", "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "versionType": "git"}, {"lessThan": "65702339b3e9fd792f65d4b740928798194d86ce", "status": "affected", "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "versionType": "git"}, {"lessThan": "49b01f2939abc676a6f9a118f07a10110ee5f683", "status": "affected", "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "versionType": "git"}, {"lessThan": "7f16289b91eb316f170a6bd22d32e6c632f6a5b6", "status": "affected", "version": "81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/hsr/hsr_device.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.17"}, {"lessThan": "3.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.110", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.52", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BAD8B9E5-FB60-4CC8-A263-40085BAD7E90", "versionEndExcluding": "6.1.188", "versionStartIncluding": "3.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5E6592C-4D9C-4D99-B17A-777E25A031F5", "versionEndExcluding": "6.6.157", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A19EC695-B7E1-41E5-B0EA-E331EFDA98A9", "versionEndExcluding": "6.12.110", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0457F732-0EA6-47D3-A69C-17A43B435D23", "versionEndExcluding": "6.18.52", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BAFE7055-A65A-44F4-BD4B-BF067EAE17F3", "versionEndExcluding": "7.2.6", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: free learned nodes on device setup failure\n\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster's state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\n\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU."}], "id": "CVE-2026-100071", "lastModified": "2026-10-21T18:46:22.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-09-25T14:17:13.567", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: net: hsr: free learned nodes on device setup failure", "id": "2541416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2541416"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet: hsr: free learned nodes on device setup failure\nhsr_dev_finalize() can fail after a lower-device RX handler has\nalready been registered (slave A is added before the failable slave B\nand interlink adds). RX handlers run in softirq regardless of the\nmaster's state, so frames received in that window can learn dynamic\nnodes into node_db, and the error unwind never releases them.\nFree both owned dynamic databases in the unwind, mirroring\nhsr_dellink(). proxy_node_db is provably empty on every current error\nexit (only interlink RX feeds it, and the interlink add is the last\nfailable step) and is freed for symmetry. The order is safe:\nhsr_del_port() unregisters each RX handler with synchronize_net()\nbefore hsr_del_nodes() runs, which removes remaining entries with\nlist_del_rcu() and defers their release with call_rcu() for readers\nalready under RCU.", "A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) networking subsystem. When device initialization fails after network receive handlers have already been registered, frames received during this setup window can create dynamic node entries that are not properly released during error cleanup. An attacker sending network traffic during a failed device setup could exploit this flaw to cause a memory leak, potentially resulting in kernel resource exhaustion and a Denial of Service (DoS)."], "name": "CVE-2026-100071", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-09-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-100071\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-100071\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-100071.mbox"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8,e691eee886871b933d772ffc76d66c80b4c0a25e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8,0a340ffd96943a49a78e367efac9517ca767d99b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8,f7289e3492f2694dccd3d79287e0e31879b58650)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8,65702339b3e9fd792f65d4b740928798194d86ce)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8,49b01f2939abc676a6f9a118f07a10110ee5f683)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[81ba6afd6e6443d2bf4bf40f16df1f1f91c603f8,7f16289b91eb316f170a6bd22d32e6c632f6a5b6)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.188,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.157,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.110,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.52,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.6,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-09-25T18:15:16.264921+00:00", "updated": "2026-10-23T00:45:13.605894+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}