VYPR
← All advisories
Medium severity5.5NVD Advisory· Published Apr 17, 2024· Updated May 12, 2026

CVE-2024-26863

CVE-2024-26863

Description

In the Linux kernel, the following vulnerability has been resolved:

hsr: Fix uninit-value access in hsr_get_node()

KMSAN reported the following uninit-value access issue [1]:

===================================================== BUG: KMSAN: uninit-value in hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 hsr_get_node+0xa2e/0xa40 net/hsr/hsr_framereg.c:246 fill_frame_info net/hsr/hsr_forward.c:577 [inline] hsr_forward_skb+0xe12/0x30e0 net/hsr/hsr_forward.c:615 hsr_dev_xmit+0x1a1/0x270 net/hsr/hsr_device.c:223 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Uninit was created at: slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x5e9/0xb10 mm/slub.c:3523 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:560 __alloc_skb+0x318/0x740 net/core/skbuff.c:651 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2787 packet_alloc_skb net/packet/af_packet.c:2936 [inline] packet_snd net/packet/af_packet.c:3030 [inline] packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x735/0xa10 net/socket.c:2191 __do_sys_sendto net/socket.c:2203 [inline] __se_sys_sendto net/socket.c:2199 [inline] __x64_sys_sendto+0x125/0x1c0 net/socket.c:2199 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x140 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b

CPU: 1 PID: 5033 Comm: syz-executor334 Not tainted 6.7.0-syzkaller-00562-g9f8413c4a66f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023 =====================================================

If the packet type ID field in the Ethernet header is either ETH_P_PRP or ETH_P_HSR, but it is not followed by an HSR tag, hsr_get_skb_sequence_nr() reads an invalid value as a sequence number. This causes the above issue.

This patch fixes the issue by returning NULL if the Ethernet header is not followed by an HSR tag.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Uninitialized memory access in Linux kernel's HSR protocol node table can lead to information disclosure.

Root

Cause Analysis

CVE-2024-26863 is a vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) protocol implementation. The issue is an uninitialized memory access (uninit-value) in the hsr_get_node() function, located in net/hsr/hsr_framereg.c. The KMSAN (Kernel Memory Sanitizer) tool detected that a node entry was accessed before its memory had been properly initialized, leading to the kernel reading stale or undefined data.

Exploitation

Mechanism

An attacker can trigger this vulnerability by sending a crafted packet via a raw packet socket (AF_PACKET) to an interface configured with HSR. The packet traverses through the networking stack, eventually reaching the HSR forwarding logic (hsr_forward_skb) which calls fill_frame_info and then hsr_get_node. When hsr_get_node attempts to look up or create a node entry, it may read from uninitialized kernel memory. No authentication is required; the attacker only needs network access to the HSR-enabled interface.

Impact

Successful exploitation results in the leakage of uninitialized kernel heap memory to the attacker, as the uninit-value can eventually be included in network responses or kernel logs. While the CVSS score is 5.5 (Medium), indicating a confidentiality impact, the vulnerability does not directly allow code execution but could provide an attacker with sensitive information about kernel memory layout or other data that may aid in further attacks.

Mitigation

Status

The fix for this vulnerability has been included in stable kernel updates. Patches are available from the Linux kernel git repository [3][4]. Users and administrators should apply the latest kernel updates from their distribution or update to a version containing the fix. Siemens has also addressed this CVE in their security advisory SSA-398330 [1] as part of a broader update for affected products.

References
  1. SSA-398330
  2. Making sure you're not a bot!
  3. Making sure you're not a bot!

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

118

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

13

News mentions

0

No linked articles in our index yet.