CVE-2025-68776
kernel: Linux kernel: Denial of Service via NULL pointer dereference in HSR
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · January 13, 2026
Updated · June 28, 2026
Description
A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) networking component. This vulnerability occurs due to a missing NULL pointer check in the prp_get_untagged_frame() function. An attacker could exploit this by triggering a scenario where a memory allocation fails, leading to a NULL pointer being passed to skb_clone(). This can result in a system crash, causing a Denial of Service (DoS).
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476 · NULL Pointer Dereference