Look up another CVE · open CVE-2026-64000 in the interactive tracker
CVE-2026-64000
net: hsr: fix potential OOB access in supervision frame handling
Published 2026-07-19 (3 months ago) by the Linux kernel CNA. Subsystem net/hsr. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-64000 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.176-1 | Update the kernel and reboot. Fixed in 6.1.176-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Ensure the entire TLV header is linearized before access by adding sizeof(struct hsr_sup_tlv) to the pskb_may_pull() calls. Without this, a truncated frame could cause an out-of-bounds access.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/hsr/hsr_forward.c
- What this is
- HSR NETWORK PROTOCOLMAINTAINERS section matched on net/hsr/ · netdev@vger.kernel.org · Orphan
- Kernel module
- hsr
Check it on the machine
grep -w CONFIG_HSR /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w hsrPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 1 release. It does build it in 3 releases, so the answer depends on which release the machine runs.
- bookwormn
- trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- n
- not enabled on any flavour - this release does not build the code
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_HSR
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-19 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.49%, higher than 40.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/hsr
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.16 | 6.1.176 | 09a37dca090c |
| 5.16 | 6.6.143 | a4b64f3e9c7b |
| 5.16 | 6.12.93 | 71c986c0ba45 |
| 5.16 | 6.18.35 | fbd0662f9c9a |
| 5.16 | 7.0.12 | 78607a6854a2 |
| 5.16 | 7.1 | f229426072fc |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The vulnerable code is reached when the kernel processes received Ethernet frames via the netdev RX handler in net/hsr, and a remote attacker on the HSR/PRP ring can deliver a crafted supervision frame without any local access to the victim host.
- AC:LAttack complexity, low
- The attacker fully controls the malformed frame content and length; a precisely truncated supervision frame reliably passes existing TLV validation and triggers the out-of-bounds read with no races or attacker-uncontrollable conditions.
- PR:NPrivileges required, none
- Exploitation requires only the ability to inject L2 HSR/PRP supervision frames onto the ring segment; no local account, capabilities, or authentication on the target kernel is needed.
- UI:NUser interaction, none
- No victim user action is required beyond normal operation of an HSR/PRP-configured node; the attacker triggers the bug solely by sending a malicious frame.
- S:UScope, unchanged
- Impact is confined to kernel memory safety within the same security authority; there is no VM escape, IOMMU bypass, or cross-security-boundary scope change.
- C:HConfidentiality impact, high
- The bug is an out-of-bounds read of supervision TLV header fields past the skb tail, which can disclose adjacent kernel heap/skb memory and is not strictly bounded to a few attacker-uncontrolled bytes.
- I:HIntegrity impact, high
- Out-of-bounds access in kernel packet parsing can supply attacker-influenced TLV type/length values that drive further skb_pull arithmetic and extended parsing, creating a plausible path to memory corruption and control-flow hijacking.
- A:HAvailability impact, high
- Reading beyond the skb buffer boundary during softirq packet processing can cause a kernel oops/panic, and the attacker can repeatedly trigger the condition with crafted frames.