CVE-2026-100071 Linux CVE debrief

Who should care

Defenders and administrators of systems utilizing the Linux kernel's net: hsr module should assess exposure and prioritize patching. This includes reviewing system configurations, monitoring logs for potential exploitation attempts, and verifying patch application.

Why it matters

CVE-2026-100071 is a resolved Linux kernel vulnerability in the net: hsr module. It involves a memory leak of learned dynamic nodes during hsr_dev_finalize() failure. Defenders should prioritize verifying and applying patches, reviewing system configurations, and monitoring logs.

• Verification of patch application is required to prevent potential memory leaks
• Monitoring system logs is necessary to detect potential exploitation attempts
• Reviewing system configurations is essential to assess exposure to the vulnerability

Technical summary

The Linux kernel's net: hsr module has a vulnerability that occurs when hsr_dev_finalize() fails after a lower-device RX handler has been registered. This leads to learned dynamic nodes being stored in node_db without being released during error unwind. The fix involves freeing both owned dynamic databases during unwind, mirroring hsr_dellink(). Affected product deployments utilizing the Linux kernel's net: hsr module should assess exposure and prioritize patching. Defenders should focus on verifying and applying patches, reviewing system configurations, and monitoring logs for potential exploitation attempts.

Defensive priority

Defenders should prioritize verifying and applying patches for this vulnerability, particularly for systems utilizing the Linux kernel's net: hsr module.

Recommended defensive actions

• Verify and apply patches for this Linux kernel vulnerability
• Review system configurations for exposure to the net: hsr module
• Monitor system logs for potential exploitation attempts
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references indicate a resolved vulnerability in the Linux kernel's net: hsr module. The issue involves the failure of hsr_dev_finalize() and the subsequent memory leak of learned dynamic nodes. The fix involves freeing dynamic databases during error unwind.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.