Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-68301

net: hsr: fix memory leak on slave unregistration by removing synced VLANs

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlan_vid0_add(), which propagates VID 0 to its slave devices (slave A and B). If a slave device is later unregistered while HSR is active (e.g., during netns cleanup or interface destruction), hsr_del_port() is called to detach the slave port from the HSR master. However, hsr_del_port() currently does not delete the VLAN IDs that were synced to the slave device by HSR. As a result, the slave device retains a refcount on VID 0 (and any other synced VLANs). When the slave device is destroyed, its vlan_info / vlan_vid_info structure remains allocated, leading to a memory leak. Fix this by calling vlan_vids_del_by_dev(port->dev, master->dev) in hsr_del_port() before unlinking slave A or slave B ports, matching the propagation logic in hsr_ndo_vlan_rx_add_vid() / hsr_ndo_vlan_rx_kill_vid() and the cleanup behavior in bonding and team drivers.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 1100242709d5644856131a9dd25d32672ebe7357 to < ccc822e9e4f09a6c2ca73ad5334570441947f94faffected
  • a2accc07bdcfb0c7ab2cacdca6a1fe8267816efa to < 79ff0547676acdeceda445c3fce4071b0a887b70affected
  • 72dbae1f2f2159395089405c6c54632f2613f1be to < f72c312af6c7897ab0f8a2b5a63f917a207a4143affected
  • c707d2c5541d2bb94131968ad5dfeb06427a1dba to < 21d48408479a17eb65568a765930adea37e4d804affected
  • 1a8a63a5305e95519de6f941922dfcd8179f82e5 to < b5ded444621b6180df9f3d4e07045fc1fc1e8cd9affected
  • 1a8a63a5305e95519de6f941922dfcd8179f82e5 to < ae995b8002d3af134560a706c0e111a89e26317caffected
  • 1a8a63a5305e95519de6f941922dfcd8179f82e5 to < dcf15eaf5641812f1cfc5e96537380132a7da89daffected
  • 5.15.194 to < 5.15.216affected
  • 6.1.153 to < 6.1.183affected
  • 6.6.107 to < 6.6.148affected
  • 6.12.48 to < 6.12.101affected

Linux Linux

Default version status: affected

  • 6.13affected
  • 0 to < 6.13unaffected
  • 5.15.216 to ≤ 5.15.*unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.148 to ≤ 6.6.*unaffected
  • 6.12.101 to ≤ 6.12.*unaffected
  • 6.18.42 to ≤ 6.18.*unaffected
  • 7.1.6 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References