CVE-2026-100071
In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes…
- Risk score
- 43/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 25 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and interlink adds). RX handlers run in softirq regardless of th…
- Affected
- Linux kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking t…
The flaws
- CVE-2026-100071: In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes… (CVSS 5.5 · EPSS 0%)
- CVE-2026-98130: Race condition (CVSS 8.1 · EPSS 0%)
- CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
- CVE-2026-98052: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last… (CVSS 7.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Linux kernel
Where it stands
- No known exploitation
Connects to
- Same weakness: Race condition (CWE-362). 93 other warnings in 30 days
- Same product: Earlier Linux kernel warnings. 61 in the last 90 days
Why it is Yellow
- CVSS 5.5 medium
- On your watchlist: linux kernel
References
- https://git.kernel.org/stable/c/0a340ffd96943a49a78e367efac9517ca767d99b
- https://git.kernel.org/stable/c/49b01f2939abc676a6f9a118f07a10110ee5f683
- https://git.kernel.org/stable/c/65702339b3e9fd792f65d4b740928798194d86ce
- https://git.kernel.org/stable/c/7f16289b91eb316f170a6bd22d32e6c632f6a5b6
- https://git.kernel.org/stable/c/e691eee886871b933d772ffc76d66c80b4c0a25e
- https://git.kernel.org/stable/c/f7289e3492f2694dccd3d79287e0e31879b58650
Original description
In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and interlink adds). RX handlers run in softirq regardless of the master's state, so frames received in that window can learn dynamic nodes into node_db, and the error unwind never releases them. Free both owned dynamic databases in the unwind, mirroring hsr_dellink(). proxy_node_db is provably empty on every current error exit (only interlink RX feeds it, and the interlink add is the last failable step) and is freed for symmetry. The order is safe: hsr_del_port() unregisters each RX handler with synchronize_net() before hsr_del_nodes() runs, which removes remaining entries with list_del_rcu() and defers their release with call_rcu() for readers already under RCU.
Last activity 25 Sep 2026. Patch Forecast updates every hour.