CVE-2026-64123

A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) networking component. When HSR node-list and node-status operations are performed, a generic-netlink reader might retain a pointer to a freed node table. This can lead to a use-after-free vulnerability, potentially allowing an attacker to cause a denial of service or information disclosure.

HSR generic netlink node operations can race with RTM_DELLINK teardown because readers walk the HSR node database under rcu_read_lock while hsr_del_nodes removed entries with list_del and freed them immediately. A local attacker who can operate on HSR devices could race node status or node list queries against link deletion and make the reader dereference a freed hsr_node object when copying node macaddress_A. For the CVSS the PR:L is used for the paranoid score because delegated CAP_NET_ADMIN or network namespace control can be sufficient in practical deployments, even if full host administration is not required. The issue is not directly network reachable and requires local control plane activity rather than packet traffic. Impact is at least local denial of service via kernel crash and may include limited confidentiality impact from stale object reads. Limited integrity impact is kept only in the paranoid score because the patch demonstrates a use after free race but not an arbitrary write primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.