CVE-2026-68301None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlan_vid0_add(), which prop…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.2%
In the Linux kernel, the following vulnerability has been resolved:
net: hsr: fix memory leak on slave unregistration by removing synced VLANs
When an HSR master device is brought UP, it auto-adds VLAN 0 via vlan_vid0_add(), which propagates VID 0 to its slave devices (slave A and B).
If a slave device is later unregistered while HSR is active (e.g., during netns cleanup or interface destruction), hsr_del_port() is called to detach the slave port from the HSR master. However, hsr_del_port() currently does not delete the VLAN IDs that were synced to the slave device by HSR.
As a result, the slave device retains a refcount on VID 0 (and any other synced VLANs). When the slave device is destroyed, its vlan_info / vlan_vid_info structure remains allocated, leading to a memory leak.
Fix this by calling vlan_vids_del_by_dev(port->dev, master->dev) in hsr_del_port() before unlinking slave A or slave B ports, matching the propagation logic in hsr_ndo_vlan_rx_add_vid() / hsr_ndo_vlan_rx_kill_vid() and the cleanup behavior in bonding and team drivers.
Linux >= 1100242709d5644856131a9dd25d32672ebe7357 < ccc822e9e4f09a6c2ca73ad5334570441947f94fLinux >= a2accc07bdcfb0c7ab2cacdca6a1fe8267816efa < 79ff0547676acdeceda445c3fce4071b0a887b70Linux >= 72dbae1f2f2159395089405c6c54632f2613f1be < f72c312af6c7897ab0f8a2b5a63f917a207a4143Linux >= c707d2c5541d2bb94131968ad5dfeb06427a1dba < 21d48408479a17eb65568a765930adea37e4d804Linux >= 1a8a63a5305e95519de6f941922dfcd8179f82e5 < b5ded444621b6180df9f3d4e07045fc1fc1e8cd9Linux >= 1a8a63a5305e95519de6f941922dfcd8179f82e5 < ae995b8002d3af134560a706c0e111a89e26317cLinux >= 1a8a63a5305e95519de6f941922dfcd8179f82e5 < dcf15eaf5641812f1cfc5e96537380132a7da89dLinux >= 5.15.194 < 5.15.216Linux >= 6.1.153 < 6.1.183Linux >= 6.6.107 < 6.6.148Linux >= 6.12.48 < 6.12.101Linux 6.13Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses