CVE-2026-100071

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the High-availability Seamless Redundancy (HSR) implementation where the hsr dev finalize() function can fail after a lower-device RX handler has been registered. Because RX handlers operate in softirq (a mechanism for handling software interrupts) regardless of the master state, frames received during this window can populate dynamic nodes into the node db database. The error unwind process fails to release these learned nodes, leading to a resource leak. The fix involves freeing both owned dynamic databases during the unwind process, ensuring hsr del port() unregisters RX handlers via synchronize net() before hsr del nodes() removes remaining entries using list del rcu() and call rcu() for RCU (Read-Copy-Update) readers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.