CVE-2026-97419

What the bug is

The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net. Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter. This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privileged listener in init_net receives events from HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port ifindex (HSR_A_IFINDEX). Switch both callers to genlmsg_multicast_netns(). Other families with .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and handshake. hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the master port via hsr_port_get_hsr().

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/hsr/hsr_netlink.c

What this is

HSR NETWORK PROTOCOLMAINTAINERS section matched on net/hsr/ · netdev@vger.kernel.org · Orphan

Kernel module

hsr

Check it on the machine

grep -w CONFIG_HSR /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w hsr

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian does not build this code in 1 release. It does build it in 4 releases, so the answer depends on which release the machine runs.

• bookwormn
• trixie, forky, sid, bookworm · linux-6.12Mnot built on amd64/cloud-amd64, arm64/cloud-arm64

n

not enabled on any flavour - this release does not build the code

M

a module where it is built at all; some flavours do not build it

Build switch

CONFIG_HSR

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-09-24 (24 days ago)source

CVSS

no vector published, unrated

Attack vector

not published

EPSS

0.17%, higher than 6.2% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

not yet assignedsource

Subsystem

net/hsr

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
3.13	5.10.271	9f13023607f1
3.13	5.15.222	798ccb12810a
3.13	6.1.189	9bf45feee630
3.13	6.6.158	016b8eaca53b
3.13	6.12.111	25b69f281ceb
3.13	6.18.53	24b3f1a9982c
3.13	7.2	a762fabd7ef9

Debian advisories