CVE-2026-68301net: hsr: fix memory leak on slave unregistration by removing synced VLANs
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlan_vid0_add(), which propagates VID 0 to its slave devices (slave A and B). If a slave device is later unregistered while HSR is active (e.g., during netns cleanup or interface destruction), hsr_del_port() is called to detach the slave port from the HSR master. However, hsr_del_port() currently does not delete the VLAN IDs that were synced to the slave device by HSR. As a result, the slave device retains a refcount on VID 0 (and any other synced VLANs). When the slave device is destroyed, its vlan_info / vlan_vid_info structure remains allocated, leading to a memory leak. Fix this by calling vlan_vids_del_by_dev(port->dev, master->dev) in hsr_del_port() before unlinking slave A or slave B ports, matching the propagation logic in hsr_ndo_vlan_rx_add_vid() / hsr_ndo_vlan_rx_kill_vid() and the cleanup behavior in bonding and team drivers.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1100242709d5644856131a9dd25d32672ebe7357 before ccc822e9e4f09a6c2ca73ad5334570441947f94f; from a2accc07bdcfb0c7ab2cacdca6a1fe8267816efa before 79ff0547676acdeceda445c3fce4071b0a887b70; from 72dbae1f2f2159395089405c6c54632f2613f1be before f72c312af6c7897ab0f8a2b5a63f917a207a4143; from c707d2c5541d2bb94131968ad5dfeb06427a1dba before 21d48408479a17eb65568a765930adea37e4d804; from 1a8a63a5305e95519de6f941922dfcd8179f82e5 before b5ded444621b6180df9f3d4e07045fc1fc1e8cd9; from 1a8a63a5305e95519de6f941922dfcd8179f82e5 before ae995b8002d3af134560a706c0e111a89e26317c; from 1a8a63a5305e95519de6f941922dfcd8179f82e5 before dcf15eaf5641812f1cfc5e96537380132a7da89d; from 5.15.194 before 5.15.216; and 3 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/ccc822e9e4f09a6c2ca73ad5334570441947f94f
- https://git.kernel.org/stable/c/79ff0547676acdeceda445c3fce4071b0a887b70
- https://git.kernel.org/stable/c/f72c312af6c7897ab0f8a2b5a63f917a207a4143
- https://git.kernel.org/stable/c/21d48408479a17eb65568a765930adea37e4d804
- https://git.kernel.org/stable/c/b5ded444621b6180df9f3d4e07045fc1fc1e8cd9
- https://git.kernel.org/stable/c/ae995b8002d3af134560a706c0e111a89e26317c
- https://git.kernel.org/stable/c/dcf15eaf5641812f1cfc5e96537380132a7da89d
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.