CVE Intelligence
Analysis AI-assisted

CVE-2026-64000: Linux kernel HSR: out-of-bounds read in supervision frame handling

A flaw in the Linux kernel HSR networking code allows a potential out-of-bounds read when supervision frames are truncated. The kernel CNA Linux rates it critical with a CVSS score of 9.8 and classifies it as CWE-125. The record shows no KEV listing and no confirmed exploitation in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The HSR networking code in the Linux kernel could read memory beyond the end of a received supervision frame when that frame was truncated. The upstream change linearizes the complete TLV header before it is accessed, removing the out-of-bounds read described in the record.

Impact

  • The record classifies the weakness as CWE-125, Out-of-bounds Read.
  • The CNA Linux assigns a CVSS 9.8 critical score with high confidentiality, integrity and availability impact, and no privileges or user interaction required.
  • The SSVC data in the record lists exploitation as none, automatable as yes and technical impact as total.

Affected products and versions

  • The record lists the Linux kernel as affected from 5.16 up to before 6.1.176, from 6.2 up to before 6.6.143, from 6.7 up to before 6.12.93, from 6.13 up to before 6.18.35, and from 6.19 up to before 7.0.12.
  • Release candidates 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4 and 7.1-rc5 are also listed as affected.

Exploitation status

The record marks this CVE as not listed in CISA KEV. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00491 with a percentile of 0.41313.

Remediation and mitigation

  • Apply the stable kernel updates that contain the upstream fix, linked from the kernel.org commits in the references.
  • The record's ranges indicate fixed stable releases at 6.1.176, 6.6.143, 6.12.93, 6.18.35 and 7.0.12 on their respective branches.
  • For the release candidates, the record does not state a final fixed release, so confirm the status with upstream or your distribution.
  • Inventory systems that run the kernel and check whether HSR functionality is in use.
  • If HSR is not required, limiting its exposure until patching is complete is a reasonable precaution (inference).

Detection guidance

  • Review kernel logs for memory-safety reports or crashes that reference the HSR code path.
  • Track whether patched kernel builds are deployed across the asset inventory.
  • Monitor hosts that use HSR for unexpected instability, since truncated frames are the triggering condition described.

Limitations of the available information

  • The record does not include technical reproduction details, and this analysis does not provide any.
  • The record does not confirm which distribution kernels backported the fix.
  • The fixed status of the listed release candidates is not stated.
  • The EPSS data in the record is dated 2026-10-23 and may change.

Frequently asked questions

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

Which kernel versions are affected?

The record lists ranges from 5.16 up to before 6.1.176, from 6.2 up to before 6.6.143, from 6.7 up to before 6.12.93, from 6.13 up to before 6.18.35, and from 6.19 up to before 7.0.12, plus release candidates 7.1-rc1 through 7.1-rc5.

What should administrators do?

Apply the stable kernel updates that include the upstream fix on the matching branch, and confirm the status of release candidates with upstream or your distribution.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.