External risk intelligence

Linux Kernel HSR Out-of-Bounds Access Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-64000

The vulnerability exists in the Linux kernel HSR (High-availability Seamless Redundancy) protocol implementation, which is a specialized networking protocol used for industrial or local area network redundancy. It is not designed for or typically exposed to the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been resolved in the Linux kernel's High-availability Seamless Redundancy (HSR) protocol, which could allow for an out-of-bounds access if a truncated frame is received. This is a technical detail related to network data handling.

Network data handling flaw resolved in Linux.
Matters if using specialized industrial network protocols.
Confirm relevance and exposure to specialized networks.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network traffic to a system running the affected Linux kernel. This traffic, if it involves the High-availability Seamless Redundancy (HSR) protocol, could cause the kernel to improperly process supervision frames. A successful attack could lead to an out-of-bounds memory access, potentially allowing an attacker to compromise the system.

Network access required.
Malformed supervision frames trigger vulnerability.
Out-of-bounds access can compromise system.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's High-availability Seamless Redundancy (HSR) protocol could allow an attacker to cause an out-of-bounds memory access when processing a truncated supervision frame. This may affect the stability of network services that rely on the HSR protocol.

Network service stability.
Malformed supervision frames.
Potential system instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's HSR protocol requires immediate attention from teams managing network infrastructure. The first critical step is to identify all systems running the affected Linux kernel version, confirm if the HSR protocol is actively used and exposed to potentially malicious network traffic, and then assign ownership for remediation planning.

Network and infrastructure teams own the issue.
Verify HSR protocol usage and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the HSR protocol in the Linux kernel?

HSR stands for High-availability Seamless Redundancy. It is a specialized networking protocol implemented within the Linux kernel designed to provide zero-loss redundancy for Ethernet networks. It is most commonly deployed in industrial environments and specialized local area networks where maintaining constant, uninterrupted communication is mission-critical.

Why does CVE-2026-64000 cause an out-of-bounds access?

This vulnerability involves a memory handling flaw during the processing of supervision frames. When the kernel receives a frame that is truncated—meaning it is shorter than expected—it fails to properly verify the frame's length before accessing the data structure. This can lead the kernel to read memory beyond the intended buffer limits, a weakness known as an out-of-bounds access.

How is this vulnerability triggered?

An attacker triggers this by sending malformed or intentionally truncated network traffic to a system. The vulnerability specifically targets the code responsible for handling HSR supervision frames. Normal, correctly formatted network traffic that does not involve truncated HSR supervision frames will not trigger this memory access error.

Is my system at risk for CVE-2026-64000?

Risk is limited to systems actively running the HSR protocol. Halo Surface Signal notes that because HSR is a specialized protocol for industrial or local network redundancy, it is typically not exposed to the public internet. If your systems are not using HSR, or if they are isolated within secure, internal industrial networks, the likelihood of this vulnerability being relevant to your environment is very low.

What should I do if I use the HSR protocol?

Begin by identifying which of your assets are running the affected Linux kernel and actively utilizing the HSR protocol. Once identified, evaluate whether these systems reside on networks that could receive untrusted traffic. Prioritize these systems for patching or configuration updates provided by your Linux distribution or kernel maintainer to resolve the memory handling error.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.