CVE-2026-64123 (GCVE-0-2026-64123)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
net: hsr: defer node table free until after RCU readers
Summary
In the Linux kernel, the following vulnerability has been resolved: net: hsr: defer node table free until after RCU readers HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately. That lets a generic-netlink reader hold a struct hsr_node pointer across hsr_dellink(). In a KASAN build, widening the reader window after hsr_get_next_node() obtains the node reproduces a slab-use-after-free when the reader copies node->macaddress_A; the freeing stack is hsr_del_nodes() from hsr_dellink(). Use list_del_rcu() and defer the free through the existing hsr_free_node_rcu() callback. This matches the lifetime rule used by the HSR prune paths, which already delete nodes with list_del_rcu() and call_rcu().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 , < 0ea70fb46940620848c08d9d399455c9e82fecdb (git)
Affected: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 , < 8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b (git)
Affected: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 , < c5580114e0492bcd2e0a37613ed4c311e3fa3d4d (git)
Affected: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 , < 7713f4aafb577ff49fa67f0488d9c7dddc64d6ce (git)
Affected: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 , < 6324423a8e6591f41a16c09a8f9a84e554ac147c (git)
Affected: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 , < 8c3af18bb0d7c921a5219194037509463eb2ffde (git)
Affected: b9a1e627405d68d475a3c1f35e685ccfb5bbe668 , < aaec7096f9961eb223b5b149abe9495525c205d9 (git)
Affected: 08523d5a2f4a9e4202e00d282c164d453cabe2d2 (git)
Affected: 5.2.12 , < 5.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_framereg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0ea70fb46940620848c08d9d399455c9e82fecdb",
              "status": "affected",
              "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
              "versionType": "git"
            },
            {
              "lessThan": "8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b",
              "status": "affected",
              "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
              "versionType": "git"
            },
            {
              "lessThan": "c5580114e0492bcd2e0a37613ed4c311e3fa3d4d",
              "status": "affected",
              "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
              "versionType": "git"
            },
            {
              "lessThan": "7713f4aafb577ff49fa67f0488d9c7dddc64d6ce",
              "status": "affected",
              "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
              "versionType": "git"
            },
            {
              "lessThan": "6324423a8e6591f41a16c09a8f9a84e554ac147c",
              "status": "affected",
              "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
              "versionType": "git"
            },
            {
              "lessThan": "8c3af18bb0d7c921a5219194037509463eb2ffde",
              "status": "affected",
              "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
              "versionType": "git"
            },
            {
              "lessThan": "aaec7096f9961eb223b5b149abe9495525c205d9",
              "status": "affected",
              "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "08523d5a2f4a9e4202e00d282c164d453cabe2d2",
              "versionType": "git"
            },
            {
              "lessThan": "5.3",
              "status": "affected",
              "version": "5.2.12",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/hsr/hsr_framereg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.2.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: defer node table free until after RCU readers\n\nHSR node-list and node-status generic-netlink operations run under\nrcu_read_lock(). They walk hsr-\u003enode_db through hsr_get_next_node() and\nhsr_get_node_data(), but RTM_DELLINK teardown removes the same node table\nwith plain list_del() and frees each node immediately.\n\nThat lets a generic-netlink reader hold a struct hsr_node pointer across\nhsr_dellink(). In a KASAN build, widening the reader window after\nhsr_get_next_node() obtains the node reproduces a slab-use-after-free\nwhen the reader copies node-\u003emacaddress_A; the freeing stack is\nhsr_del_nodes() from hsr_dellink().\n\nUse list_del_rcu() and defer the free through the existing\nhsr_free_node_rcu() callback. This matches the lifetime rule used by the\nHSR prune paths, which already delete nodes with list_del_rcu() and\ncall_rcu()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local netlink access: generic-netlink HSR_C_GET_NODE_LIST/HSR_C_GET_NODE_STATUS and rtnetlink RTM_DELLINK. The bug is not reachable via HSR/PRP network frames despite HSR being a network redundancy protocol.\nAC:L - The attacker controls both sides of the race by issuing concurrent GENL node queries and RTM_DELLINK on separate threads; no unpredictable victim state or memory layout is required beyond having an HSR interface configured.\nPR:L - Reliable exploitation requires CAP_NET_ADMIN to delete the HSR device via RTM_DELLINK (and typically to create it); CAP_NET_ADMIN is obtainable by an unprivileged user through user namespaces (unshare -Urn), and the GENL read operations themselves carry no admin-perm flag.\nUI:N - No victim interaction is required; the race is triggered entirely by the attacker\u0027s own concurrent netlink operations.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel/host security boundary, not a cross-boundary escape such as VM or sandbox breakout.\nC:H - This is a slab use-after-free on struct hsr_node; freed objects can be reallocated and read through fields like macaddress_A/B and block_buf, enabling arbitrary kernel memory disclosure.\nI:H - UAF on a kmalloc\u0027d hsr_node with spinlock and pointer fields (block_buf, seq_blocks) provides standard heap-spray primitives for arbitrary kernel writes and potential code execution.\nA:H - Use-after-free on hsr_node during RCU-protected traversal causes kernel oops/panic even without full exploitation, as confirmed by KASAN on the macaddress_A copy path."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:29.748Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb"
        },
        {
          "url": "https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde"
        },
        {
          "url": "https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9"
        }
      ],
      "title": "net: hsr: defer node table free until after RCU readers",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64123",
    "datePublished": "2026-07-19T15:40:21.161Z",
    "dateReserved": "2026-07-19T07:54:57.036Z",
    "dateUpdated": "2026-08-05T12:39:29.748Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64123",
      "date": "2026-09-21",
      "epss": "0.00126",
      "percentile": "0.02592"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/hsr/hsr_framereg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0ea70fb46940620848c08d9d399455c9e82fecdb",
                    "status": "affected",
                    "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b",
                    "status": "affected",
                    "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c5580114e0492bcd2e0a37613ed4c311e3fa3d4d",
                    "status": "affected",
                    "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7713f4aafb577ff49fa67f0488d9c7dddc64d6ce",
                    "status": "affected",
                    "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6324423a8e6591f41a16c09a8f9a84e554ac147c",
                    "status": "affected",
                    "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8c3af18bb0d7c921a5219194037509463eb2ffde",
                    "status": "affected",
                    "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "aaec7096f9961eb223b5b149abe9495525c205d9",
                    "status": "affected",
                    "version": "b9a1e627405d68d475a3c1f35e685ccfb5bbe668",
                    "versionType": "git"
                  },
                  {
                    "status": "affected",
                    "version": "08523d5a2f4a9e4202e00d282c164d453cabe2d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "affected",
                    "version": "5.2.12",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/hsr/hsr_framereg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.3"
                  },
                  {
                    "lessThan": "5.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0E0DEBC5-C40E-4570-A95A-423F7A843940",
                    "versionEndExcluding": "5.10.259",
                    "versionStartIncluding": "5.2.12",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
                    "versionEndExcluding": "5.15.210",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
                    "versionEndExcluding": "6.1.176",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
                    "versionEndExcluding": "6.6.143",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63",
                    "versionEndExcluding": "6.12.93",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "71B52372-E5FB-48F2-8BF9-79BA0328158F",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: hsr: defer node table free until after RCU readers\n\nHSR node-list and node-status generic-netlink operations run under\nrcu_read_lock(). They walk hsr-\u003enode_db through hsr_get_next_node() and\nhsr_get_node_data(), but RTM_DELLINK teardown removes the same node table\nwith plain list_del() and frees each node immediately.\n\nThat lets a generic-netlink reader hold a struct hsr_node pointer across\nhsr_dellink(). In a KASAN build, widening the reader window after\nhsr_get_next_node() obtains the node reproduces a slab-use-after-free\nwhen the reader copies node-\u003emacaddress_A; the freeing stack is\nhsr_del_nodes() from hsr_dellink().\n\nUse list_del_rcu() and defer the free through the existing\nhsr_free_node_rcu() callback. This matches the lifetime rule used by the\nHSR prune paths, which already delete nodes with list_del_rcu() and\ncall_rcu()."
          }
        ],
        "id": "CVE-2026-64123",
        "lastModified": "2026-08-13T15:11:32.297",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:53.907",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/0ea70fb46940620848c08d9d399455c9e82fecdb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6324423a8e6591f41a16c09a8f9a84e554ac147c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/7713f4aafb577ff49fa67f0488d9c7dddc64d6ce"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8be6685cdd1255bcc85f9b59e4bfc313aefc5c1b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8c3af18bb0d7c921a5219194037509463eb2ffde"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/aaec7096f9961eb223b5b149abe9495525c205d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c5580114e0492bcd2e0a37613ed4c311e3fa3d4d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-20T16:47:47+00:00",
      "cve": "CVE-2026-64123",
      "id": "CVE-2026-64123",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: hsr: defer node table free until after RCU readers",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64123.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:55:03Z",
      "cve": "CVE-2026-64123",
      "id": "CVE-2026-64123",
      "initial_release_date": "2026-07-21T12:59:17Z",
      "product_status:known_affected": "277",
      "product_status:known_not_affected": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64123",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64123.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.