CVE-2025-39703

A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) networking subsystem. This flaw allows an adjacent network attacker or a local user to cause a denial of service (DoS) by transmitting malformed HSR network frames with incomplete tags. Due to insufficient packet length validation, processing these frames corrupts internal buffer state, triggering a kernel panic and crashing the system.

The vulnerability resides in the HSR networking stack, where a malformed HSR frame with an incomplete tag can corrupt skb state and eventually trigger a kernel panic. Since the issue requires either local packet injection (AF_PACKET) or network adjacency on an HSR-enabled interface, the attack surface is limited but realistic in specialized environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.