In the Linux kernel, the following vulnerability has been resolved:
hsr: Fix uninit-value access in fill_frame_info()
Syzbot reports the following uninit-value access problem.
===================================================== BUG: KMSAN: uninit-value in fill_frame_info net/hsr/hsr_forward.c:601 [inline] BUG: KMSAN: uninit-value in hsr_forward_skb+0x9bd/0x30f0 net/hsr/hsr_forward.c:616 fill_frame_info net/hsr/hsr_forward.c:601 [inline] hsr_forward_skb+0x9bd/0x30f0 net/hsr/hsr_forward.c:616 hsr_dev_xmit+0x192/0x330 net/hsr/hsr_device.c:223 __netdev_start_xmit include/linux/netdevice.h:4889 [inline] netdev_start_xmit include/linux/netdevice.h:4903 [inline] xmit_one net/core/dev.c:3544 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3560 __dev_queue_xmit+0x34d0/0x52a0 net/core/dev.c:4340 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] __sys_sendto+0x781/0xa30 net/socket.c:2176 __do_sys_sendto net/socket.c:2188 [inline] __se_sys_sendto net/socket.c:2184 [inline] __ia32_sys_sendto+0x11f/0x1c0 net/socket.c:2184 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at: slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767 slab_alloc_node mm/slub.c:3478 [inline] kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523 kmalloc_reserve+0x148/0x470 net/core/skbuff.c:559 __alloc_skb+0x318/0x740 net/core/skbuff.c:644 alloc_skb include/linux/skbuff.h:1286 [inline] alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6299 sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2794 packet_alloc_skb net/packet/af_packet.c:2936 [inline] packet_snd net/packet/af_packet.c:3030 [inline] packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:730 [inline] sock_sendmsg net/socket.c:753 [inline] __sys_sendto+0x781/0xa30 net/socket.c:2176 __do_sys_sendto net/socket.c:2188 [inline] __se_sys_sendto net/socket.c:2184 [inline] __ia32_sys_sendto+0x11f/0x1c0 net/socket.c:2184 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82
It is because VLAN not yet supported in hsr driver. Return error when protocol is ETH_P_8021Q in fill_frame_info() now to fix it.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-toolsUpgrade bpftool-debuginfoUpgrade python-perfUpgrade kernel-livepatch-5.10.196-185.743Upgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade bpftoolUpgrade python-perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-headersUpgrade kernelUpgrade kernel-livepatch-5.15.133-86.144Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-livepatch-6.1.55-75.123Upgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade perfUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-libbpf-develUpgrade kernel-libbpf-staticUpgrade python3-perf-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernelUpgrade bpftoolUpgrade kernel-headers | Oct 24, 2025 | Oct 1, 2025 |
| Debian | — | Upgrade linux | Oct 3, 2025 | Oct 3, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 1, 2025 |
| Ubuntu | — | Upgrade linux-realtimeUpgrade linux-nvidia-tegra-igxUpgrade linux-awsUpgrade linux-intel-iotgUpgrade linux-gcp-fipsUpgrade linux-intel-iot-realtimeUpgrade linux-gcp-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-riscv-5.15Upgrade linux-bluefieldUpgrade linux-gcpUpgrade linux-azure-5.15Upgrade linux-raspiUpgrade linux-aws-5.15Upgrade linux-nvidia-tegraUpgrade linux-ibmUpgrade linux-fipsUpgrade linux-nvidia-tegra-5.15Upgrade linuxUpgrade linux-xilinx-zynqmpUpgrade linux-oracleUpgrade linux-intel-iotg-5.15Upgrade linux-gkeopUpgrade linux-aws-fipsUpgrade linux-ibm-5.15Upgrade linux-oracle-5.15Upgrade linux-nvidiaUpgrade linux-hwe-5.15Upgrade linux-kvmUpgrade linux-lowlatencyUpgrade linux-azureUpgrade linux-gke | Oct 10, 2025 | Oct 1, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Oct 1, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub