CVE-2026-97419 hsr: broadcast netlink notifications in the device's net namespace
Privileged listeners in the initial network namespace can receive sensitive HSR device events from other namespaces, leaking MAC addresses and interface indices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97419?
CVE-2026-97419 is a vulnerability in Linux, published on 24 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
hsr: broadcast netlink notifications in the device's net namespace
The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net.
Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter.
This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privileged listener in init_net receives events from HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port ifindex (HSR_A_IFINDEX).
Switch both callers to genlmsg_multicast_netns(). Other families with .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and handshake.
hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the master port via hsr_port_get_hsr().
Which versions are affected by CVE-2026-97419?
How do I fix CVE-2026-97419?
Apply the vendor's patch.
Is CVE-2026-97419 being exploited?
There is no known exploitation of CVE-2026-97419 in the wild and no public exploit code.
Sources
Also known as AZL-103916, BELL-CVE-2026-97419, DEBIAN-CVE-2026-97419, GHSA-v886-hjg7-fghx, UBUNTU-CVE-2026-97419.