Skip to main content

Linux Kernel EUVDEUVD-2026-40987

| CVE-2026-53353 MEDIUM
2026-07-01 Linux GHSA-j8j2-8gr5-pf32
Information Disclosure Linux Google
5.5
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local unprivileged access
  2. Delivery
    Identify or configure active HSR network device
  3. Exploit
    Initiate HSR device deletion (hsr_dellink)
  4. Execution
    Concurrently send packet via sendmsg through HSR device
  5. Persist
    Race into NULL hsr->self_node window in hsr_addr_is_self
  6. Impact
    Trigger WARN_ONCE causing kernel panic on panic_on_warn=1 systems

Vulnerability Assessment

Exploitation Conditions

Three specific conditions must all be present: (1) the hsr kernel module must be loaded and at least one HSR network interface must be configured and operationally active - the HSR subsystem is not loaded by default on general-purpose Linux distributions and is primarily deployed in IEC 62439-3 compliant industrial Ethernet environments; (2) the attacker must have local unprivileged access (CVSS PR:L) sufficient to invoke sendmsg() on a socket routed through the HSR device; (3) the exploit must coincide with the narrow device teardown window between hsr_dellink() returning and unregister_netdevice_many() completing, requiring precise timing or repeated race attempts. What limits exploitation: the HSR module is niche and absent from default kernel module loading policies on most general-purpose distributions; a race window with uncertain width requires repeated attempts; without panic_on_warn=1, the impact is a kernel warning log entry rather than a panic, substantially reducing the denial-of-service severity; and the attacker must have physical or logical local presence on the affected host.
Impact

CVSS 5.5 (Medium) with AV:L/PR:L appropriately reflects that exploitation is local and requires the niche HSR subsystem to be active. EPSS of 0.16% at the 5th percentile confirms extremely low exploitation probability consistent with no known weaponization. The vulnerability is absent from CISA KEV. Syzbot discovery indicates automated fuzzer reachability but not attacker-driven exploitation. Real-world risk is further constrained by the HSR module's deployment context: it targets industrial Ethernet environments following IEC 62439-3 and is not loaded by default on general-purpose Linux systems. The availability impact escalates sharply on kernels with panic_on_warn=1 (converting a WARN_ONCE into a kernel panic), but this is a hardened kernel configuration less common in production. For mainstream Linux deployments, this represents a medium-priority, patch-on-cycle issue rather than an emergency. For industrial control systems running HSR-based networking, patching is warranted sooner given local access assumptions may be weaker in those environments.
Exploit ScenarioDerived

A local attacker with a standard unprivileged account on a Linux system running the HSR networking subsystem sends raw IP packets via sendmsg() through an active HSR virtual device while concurrently triggering device deletion via RTNL. The narrow window between hsr_del_self_node() clearing hsr->self_node and unregister_netdevice_many() completing allows hsr_addr_is_self() to execute with a NULL self_node pointer, firing WARN_ONCE(); on kernels with panic_on_warn=1 this immediately panics the kernel, denying service to all users on the system.
This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Race condition in the Linux kernel HSR (High-availability Seamless Redundancy) subsystem triggers a WARN_ONCE() during device teardown, potentially causing denial of service on affected systems. The flaw exists in hsr_addr_is_self() at net/hsr/hsr_framereg.c:39, where hsr->self_node is NULLed by hsr_del_self_node() before unregister_netdevice_many() completes, leaving a window for concurrent packet transmission to access a NULL pointer. On kernels configured with panic_on_warn=1, this warning escalates to a full kernel panic; no public exploit identified at time of analysis, and the vulnerability was discovered by Google's syzbot kernel fuzzer with EPSS at the 5th percentile.

RemediationAI

Vendor-released patch is available. Upgrade to Linux kernel 6.6.143, 6.12.94, 6.18.36, 7.0.13, or 7.1 depending on the deployed stable branch; the fix removes the erroneous WARN_ONCE() from hsr_addr_is_self() since the NULL self_node condition is a valid race outcome during teardown, not a logic error. Fix commits are at the kernel stable tree links listed above. For systems where immediate patching is not feasible and HSR networking is not required, blacklist or unload the hsr kernel module: echo 'blacklist hsr' >> /etc/modprobe.d/blacklist.conf && modprobe -r hsr - this eliminates the attack surface entirely with no functional trade-off for non-industrial hosts. On systems with panic_on_warn=1 where patching is delayed, consider sysctl kernel.panic_on_warn=0 as a compensating control to downgrade the impact from a kernel panic to a non-fatal warning; note this reduces kernel hardening posture and should be treated as temporary. Linux distribution vendors (Red Hat, Ubuntu, SUSE, Debian) will ship backported fixes in their respective kernel packages.

Affected VersionsENISA

Linux patch: 6.18.36
Linux patch: 7.0.13
Linux f266a683a4804dc499efc6c2206ef68efed029d0 <66a46e22396fd5d09606f37f73643eb20e99aa42
Linux f266a683a4804dc499efc6c2206ef68efed029d0 <afd0f17ca46258cec3a5cc48b8df9327fe772490
Linux patch: 7.1
Linux f266a683a4804dc499efc6c2206ef68efed029d0 <d71bb171661ec0225bf4babdd4d296d744982fb3
Linux patch: 6.12.94
Linux patch: 6.6.143
Linux patch: 0
Linux f266a683a4804dc499efc6c2206ef68efed029d0 <0232b6fcb7615fb7fecfe0727a23065a53e228b8
Linux f266a683a4804dc499efc6c2206ef68efed029d0 <271355c2ef6171dbc815e7ae653eed63444bbd58
Linux 3.17

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The HSR (High-availability Seamless Redundancy) module implements IEC 62439-3 industrial Ethernet redundancy and was introduced at kernel 3.17 (commit f266a683a4804dc499efc6c2206ef68efed029d0). The race window exists in the device lifecycle: hsr_dellink() calls hsr_del_self_node() which clears hsr->self_node, but the netdevice remains discoverable until unregister_netdevice_many() completes. A concurrent sendmsg() call traversing the path hsr_dev_xmit() → hsr_forward_skb() → check_local_dest() → fill_frame_info() → hsr_addr_is_self() can enter this window and encounter a NULL hsr->self_node, firing WARN_ONCE(). Though no CWE is formally assigned, this maps to CWE-362 (Race Condition) and CWE-476 (NULL Pointer Dereference). CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*. The CVSS vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects local triggering by a low-privileged process during an inherently kernel-internal operation.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI 4.7 MEDIUM

Race condition requires precise teardown timing, warranting AC:H; PR:L reflects local unprivileged packet-send capability; A:H conditional on panic_on_warn kernel configuration.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 0.0 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
Red Hat 5.5 LOW

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
CVSS changed
Jul 22, 2026 - 19:22 NVD
5.5 (MEDIUM)
Patch available
Jul 01, 2026 - 15:16 EUVD
CVE Published
Jul 01, 2026 - 13:32 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 01, 2026 - 13:32 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

hsr: Remove WARN_ONCE() in hsr_addr_is_self().

syzbot reported the warning [0] in hsr_addr_is_self(), whose assumption is simply wrong.

hsr->self_node is cleared in hsr_del_self_node(), which is called from hsr_dellink().

Since dev->rtnl_link_ops->dellink() is called before unregister_netdevice_many(), there is a window when user can find the device but without hsr->self_node.

Let's remove WARN_ONCE() in hsr_addr_is_self().

[0]: HSR: No self node WARNING: net/hsr/hsr_framereg.c:39 at hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39, CPU#0: syz.4.16848/17220 Modules linked in: CPU: 0 UID: 0 PID: 17220 Comm: syz.4.16848 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:hsr_addr_is_self+0x211/0x3f0 net/hsr/hsr_framereg.c:39 Code: 33 2f 41 0f b7 dd 89 ee 09 de 31 ff e8 c8 b4 c6 f6 09 dd 74 54 e8 0f b0 c6 f6 31 ed eb 53 e8 06 b0 c6 f6 48 8d 3d 2f 50 9c 04 <67> 48 0f b9 3a 31 ed eb 42 e8 c1 13 1f 00 89 c5 31 ff 89 c6 e8 96 RSP: 0018:ffffc900041c70e0 EFLAGS: 00010283 RAX: ffffffff8afdc6ca RBX: ffffffff8afdc4e6 RCX: 0000000000080000 RDX: ffffc90010493000 RSI: 0000000000000948 RDI: ffffffff8f9a1700 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 R10: ffffc900041c71e8 R11: fffff52000838e3f R12: dffffc0000000000 R13: ffff888041f9e3c0 R14: ffff888086ee3802 R15: 0000000000000000 FS: 00007f6fe985d6c0(0000) GS:ffff888126176000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f80bd437dac CR3: 0000000025096000 CR4: 00000000003526f0 DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002 DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: <TASK> check_local_dest net/hsr/hsr_forward.c:592 [inline] fill_frame_info net/hsr/hsr_forward.c:728 [inline] hsr_forward_skb+0xa11/0x2a80 net/hsr/hsr_forward.c:739 hsr_dev_xmit+0x253/0x370 net/hsr/hsr_device.c:236 __netdev_start_xmit include/linux/netdevice.h:5368 [inline] netdev_start_xmit include/linux/netdevice.h:5377 [inline] xmit_one net/core/dev.c:3888 [inline] dev_hard_start_xmit+0x2df/0x860 net/core/dev.c:3904 __dev_queue_xmit+0x1428/0x3900 net/core/dev.c:4870 neigh_output include/net/neighbour.h:556 [inline] ip_finish_output2+0xcec/0x10b0 net/ipv4/ip_output.c:237 ip_send_skb net/ipv4/ip_output.c:1510 [inline] ip_push_pending_frames+0x8b/0x110 net/ipv4/ip_output.c:1530 raw_sendmsg+0x1547/0x1a50 net/ipv4/raw.c:659 sock_sendmsg_nosec net/socket.c:787 [inline] __sock_sendmsg net/socket.c:802 [inline] ____sys_sendmsg+0x7da/0x9c0 net/socket.c:2698 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752 __sys_sendmsg net/socket.c:2784 [inline] __do_sys_sendmsg net/socket.c:2789 [inline] __se_sys_sendmsg net/socket.c:2787 [inline] __x64_sys_sendmsg+0x1c3/0x2a0 net/socket.c:2787 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6feb62ce59 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6fe985d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f6feb8a6090 RCX: 00007f6feb62ce59 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 RBP: 00007f6feb6c2d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6feb8a6128 R14: 00007f6feb8a6090 R15: 00007ffcf01cc488 </TASK>

Threat Intelligence Overview

EPSS Score
0.2%
Top 95% exploitable
Prevalence
Ubiquitous
Linux kernel runs on most servers, cloud, and embedded systems globally
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity MEDIUM
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
MEDIUM severity (CVSS 4.0-6.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact· derived
High

Priority Score

28
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +28
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-53353 ADVISORY https://seclists.org/oss-sec/2026/q3/230 ADVISORY https://ubuntu.com/security/notices/USN-8726-1 ADVISORY https://ubuntu.com/security/notices/USN-8727-1 ADVISORY https://vuldb.com/vuln/375525 REF https://git.kernel.org/stable/c/0232b6fcb7615fb7fecfe0727a23065a53e228b8 REF https://git.kernel.org/stable/c/271355c2ef6171dbc815e7ae653eed63444bbd58 REF https://git.kernel.org/stable/c/4d256cddc47c0c34ffcf7e5205ee4c38863bf457 REF https://git.kernel.org/stable/c/66a46e22396fd5d09606f37f73643eb20e99aa42 REF https://git.kernel.org/stable/c/7610e3298aeb2439caa735131265fb634e0db4ec REF https://git.kernel.org/stable/c/afd0f17ca46258cec3a5cc48b8df9327fe772490 REF https://git.kernel.org/stable/c/d71bb171661ec0225bf4babdd4d296d744982fb3 REF https://git.kernel.org/stable/c/ff88df6d6a72458e1c4ca0e0342327cafd8317f4

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy