All vulnerabilities
CVE-2026-97419

Linux: hsr: broadcast netlink notifications in the device's net namespace

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9f13023607f1e95bd098cc49052b0c8955d334f9Also 798ccb12810a58a37264685b28ddf990ef49559c, 9bf45feee630be868ab54e3d0f3d430c07471f0e and 3 moreCVE List
Published24 Sep 2026Updated 3 Oct 2026CVE List

What fixes it

  • 9f13023607f1e95bd098cc49052b0c8955d334f9LinuxCVE List
  • 798ccb12810a58a37264685b28ddf990ef49559cLinuxCVE List
  • 9bf45feee630be868ab54e3d0f3d430c07471f0eLinuxCVE List
  • 016b8eaca53bfd57e84ea28b5c9174c89d7679e1LinuxCVE List
  • 25b69f281cebe051a8e4ab19950a939c27ead1bcLinuxCVE List
  • 24b3f1a9982c176d05a523a4bb9314dca0db4488LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

hsr: broadcast netlink notifications in the device's net namespace

The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net.

Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter.

This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privileged listener in init_net receives events from HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port ifindex (HSR_A_IFINDEX).

Switch both callers to genlmsg_multicast_netns(). Other families with .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and handshake.

hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the master port via hsr_port_get_hsr().

Text from CVE List

Affected versions 16

  • Linuxaffected: f421436a591d34fa5279b54a96ac07d70250cc8d before 9f13023607f1e95bd098cc49052b0c8955d334f9CVE List
  • Linuxaffected: f421436a591d34fa5279b54a96ac07d70250cc8d before 798ccb12810a58a37264685b28ddf990ef49559cCVE List
  • Linuxaffected: f421436a591d34fa5279b54a96ac07d70250cc8d before 9bf45feee630be868ab54e3d0f3d430c07471f0eCVE List
  • Linuxaffected: f421436a591d34fa5279b54a96ac07d70250cc8d before 016b8eaca53bfd57e84ea28b5c9174c89d7679e1CVE List
  • Linuxaffected: f421436a591d34fa5279b54a96ac07d70250cc8d before 25b69f281cebe051a8e4ab19950a939c27ead1bcCVE List
  • Linuxaffected: f421436a591d34fa5279b54a96ac07d70250cc8d before 24b3f1a9982c176d05a523a4bb9314dca0db4488CVE List
  • Linuxaffected: f421436a591d34fa5279b54a96ac07d70250cc8d before a762fabd7ef9a6cc07258684138f9c3f078d0326CVE List
  • Linuxaffected: 3.13CVE List
  • Linuxunaffected: all versions before 3.13CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2CVE List

References 7