CVE-2026-64000
A critical vulnerability in the Linux kernel’s HSR supervision frame handling could allow an attacker to cause an out‑of‑bounds memory read by sending a truncated frame. The issue has been fixed by ensuring the TLV header is fully linearized before access.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel, specifically the HSR (High‑availability Seamless Redundancy) module. Any system running a kernel version before the fix is vulnerable.
Real-world impact
An attacker could send a specially crafted truncated frame to a vulnerable device, causing the kernel to read memory outside the intended bounds. This could lead to a crash, denial of service, or potentially arbitrary code execution if the read is used in a way that influences control flow.
Why this severity
The CVSS score of 9.8 reflects that the flaw can be exploited remotely with no authentication or user interaction, and it can compromise confidentiality, integrity, and availability of the affected system.
What to do about it
- 01Update the Linux kernel to a version that includes the fix for CVE-2026-64000.
NVD-referenced vendor advisory
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.