CVE-2026-100071 net: hsr: free learned nodes on device setup failure
A memory leak in the Linux kernel HSR driver allows attackers to cause denial of service by sending frames during device setup failure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-100071?
CVE-2026-100071 is a medium-severity memory corruption vulnerability in Linux kernel, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: free learned nodes on device setup failure
hsr_dev_finalize() can fail after a lower-device RX handler has already been registered (slave A is added before the failable slave B and interlink adds). RX handlers run in softirq regardless of the master's state, so frames received in that window can learn dynamic nodes into node_db, and the error unwind never releases them.
Free both owned dynamic databases in the unwind, mirroring hsr_dellink(). proxy_node_db is provably empty on every current error exit (only interlink RX feeds it, and the interlink add is the last failable step) and is freed for symmetry. The order is safe: hsr_del_port() unregisters each RX handler with synchronize_net() before hsr_del_nodes() runs, which removes remaining entries with list_del_rcu() and defers their release with call_rcu() for readers already under RCU.
Which versions are affected by CVE-2026-100071?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-100071?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-100071 being exploited?
There is no known exploitation of CVE-2026-100071 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-100071, DEBIAN-CVE-2026-100071, GHSA-rfjf-r326-rpvj, UBUNTU-CVE-2026-100071.