CVE-2026-97419 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux-based systems should assess exposure and prioritize verification of kernel updates and patch application. The vulnerability allows broadcast netlink notifications in the device's net namespace, potentially exposing sensitive information or disrupting network operations. Affected product or component review is necessary to determine the scope of the

Why it matters

A vulnerability in the Linux kernel's HSR implementation could allow an attacker to broadcast netlink notifications in the device's net namespace, potentially exposing sensitive information or disrupting network operations. Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux-based systems should assess exposure and prioritize verification of kernel updates and patch application.

• Verification of kernel updates and patch application priority.
• Monitoring of network operations for potential disruptions or anomalies.
• Review of system configurations to prevent unauthorized access to sensitive information.

Technical summary

The Linux kernel's HSR implementation has a vulnerability that allows broadcast netlink notifications in the device's net namespace. This could potentially expose sensitive information or disrupt network operations. The vulnerability arises from the HSR generic netlink family setting .netnsok = true, allowing HSR devices to live in network namespaces other than init_net. Two async notifiers, hsr_nl_ringerror() and hsr_nl_nodedown(), broadcast events with genlmsg_multicast(), but they only deliver on the default genl socket in init_net.

Defensive priority

Medium

Recommended defensive actions

• Review and apply kernel updates to ensure the latest security patches are installed.
• Monitor network operations for potential disruptions or anomalies.
• Verify system configurations to prevent unauthorized access to sensitive information.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and potential impact require further verification and defensive review. Linux kernel developers and maintainers, network administrators, and security teams should assess exposure and prioritize verification of kernel updates and patch application. The vulnerability allows broadcast netlink notifications in the device's net namespace, potentially exposing sensitive information or disrupting network operations. Affected product or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.