CVE-2026-64000

A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) module. This vulnerability allows an attacker to cause an out-of-bounds (OOB) access by sending a specially crafted, truncated supervision frame. The issue arises because the system does not ensure the entire TLV (Type-Length-Value) header is properly processed before memory access. This could lead to system instability or denial of service.

An out of bounds read can occur in the HSR supervision frame parser because the code may access the next TLV header before the full struct hsr_sup_tlv is present and linearized in the skb. A truncated or malformed HSR supervision frame from an adjacent Layer 2 network can reach this path and may cause a kernel crash or other availability impact. For the CVSS the PR:N because an attacker only needs adjacent network reachability to an exposed HSR interface and no local account on the target. The issue is not Internet routable in normal deployments because HSR is an Ethernet redundancy protocol used mainly in local industrial or availability focused networks. Impact is at least denial of service. In the paranoid score limited confidentiality and integrity impact is kept because the primitive is an OOB read in kernel packet parsing, but there is no evidence of OOB write or a direct privilege escalation primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.