CVE-2026-97419
Description
A flaw was found in the Linux kernel's High-availability Seamless Redundancy (HSR) subsystem. When ring error or node down events occur, asynchronous netlink notifications are broadcast exclusively to the root network namespace rather than the device's specific network namespace. This issue allows a local user in the initial network namespace to intercept sensitive network metadata, including peer Media Access Control (MAC) addresses and interface indices from isolated environments, resulting in cross-namespace information disclosure. Additionally, listeners within the device's designated namespace fail to receive these status notifications.
Statement
A moderate severity flaw was found in the Linux kernel High-availability Seamless Redundancy (HSR) subsystem. The HSR generic netlink family permits HSR devices to exist in network namespaces other than the initial namespace, but the asynchronous ring error (hsr_nl_ringerror) and node down (hsr_nl_nodedown) notifiers broadcast their notifications only to the initial (root) network namespace via genlmsg_multicast(), regardless of the device's own namespace. As a result, a local user able to listen in the initial network namespace could observe ring error and node down notifications for HSR devices in other namespaces, exposing limited network metadata such as peer node MAC addresses (HSR_A_NODE_ADDR) and slave port interface indices (HSR_A_IFINDEX), while listeners in the device's own namespace never received these status events. Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases based on RHEL CoreOS 9 are affected; the fix is currently deferred for these products, and the residual risk is limited to local cross-namespace disclosure of network metadata and to missing HSR status notifications within the device's namespace. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Access Control,Other
Technical Impact: Gain Privileges or Assume Identity; Varies by Context; Bypass Protection Mechanism
An attacker at the destination may be able to spoof trusted servers to steal data or cause a denial of service. The attacker can access any functionality that is inadvertently accessible to the source. - If the product allows an attacker to control/specify the destination, then the attacker can cause it to connect to an untrusted or malicious destination. For example, because UDP is a connectionless protocol, UDP packets can be spoofed by specifying a false source address in the packet; when the server receives the packet and sends a reply, it will specify a destination by using the source of the incoming packet - i.e., the false source. The server can then be tricked into sending traffic to the wrong host, which is effective for hiding the real source of an attack and for conducting a distributed denial of service (DDoS). As another example, server-side request forgery (SSRF) and XML External Entity (XXE) can be used to trick a server into making outgoing requests to hosts that cannot be directly accessed by the attacker due to firewall restrictions. If the product incorrectly specifies the destination, then an attacker who can control this destination might be able to spoof trusted components or servers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
