CVE-2024-26707

net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()

MEDIUM
5.5
CVSS Score
Published: April 3, 2024 at 02:55 PM UTC
Updated: June 17, 2026 at 07:18 AM UTC
2 products affected across 2 vendorsLinux KernelDebian Linux

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsr_init_skb(). Since a WARN_ONCE() call will not help much in this case, it might be prudent to switch to netdev_warn_once(). At the very least it will suppress syzkaller reports such as [1]. Just in case, use netdev_warn_once() in send_prp_supervision_frame() for similar reasons. [1] HSR: Could not send supervision frame WARNING: CPU: 1 PID: 85 at net/hsr/hsr_device.c:294 send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294 RIP: 0010:send_hsr_supervision_frame+0x60a/0x810 net/hsr/hsr_device.c:294 ... Call Trace: <IRQ> hsr_announce+0x114/0x370 net/hsr/hsr_device.c:382 call_timer_fn+0x193/0x590 kernel/time/timer.c:1700 expire_timers kernel/time/timer.c:1751 [inline] __run_timers+0x764/0xb20 kernel/time/timer.c:2022 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035 __do_softirq+0x21a/0x8de kernel/softirq.c:553 invoke_softirq kernel/softirq.c:427 [inline] __irq_exit_rcu kernel/softirq.c:632 [inline] irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644 sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 ... This issue is also found in older kernels (at least up to 5.10).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

5.11 ≤ v < 5.15.1495.16 ≤ v < 6.1.795.9 ≤ v < 5.10.2105.9 ≤ v < 5.15.1495.9 ≤ v < 6.1.795.9 ≤ v < 6.6.185.9 ≤ v < 6.7.65.9 ≤ v < 6.86.2 ≤ v < 6.6.186.7 ≤ v < 6.7.6121c33b07b3127f501b366bc23d2a590e2f2b8ef6.8 rc16.8 rc2
Vendor states this is fixed in 0d8011a878fdf96123bc0d6a12e2fe7ced5fddfb (fixed)
Vendor states this is fixed in 37e8c97e539015637cb920d3e6f1e404f707a06e (fixed)
Vendor states this is fixed in 547545e50c913861219947ce490c68a1776b9b51 (fixed)
Vendor states this is fixed in 56440799fc4621c279df16176f83a995d056023a (fixed)
Vendor states this is fixed in 923dea2a7ea9e1ef5ac4031fba461c1cc92e32b8 (fixed)
Vendor states this is fixed in de769423b2f053182a41317c4db5a927e90622a0 (fixed)
Vendor states this is fixed in 5.10.210 (unaffected)
Vendor states this is fixed in 5.15.149 (unaffected)
Vendor states this is fixed in 5.9 (unaffected)
Vendor states this is fixed in 6.1.79 (unaffected)
Vendor states this is fixed in 6.6.18 (unaffected)
Vendor states this is fixed in 6.7.6 (unaffected)
Vendor states this is fixed in 6.8 (unaffected)

References (7)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/0d8011a878fdf96123bc0d6a12e2fe7ced5fddfb
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/37e8c97e539015637cb920d3e6f1e404f707a06e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/547545e50c913861219947ce490c68a1776b9b51
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/56440799fc4621c279df16176f83a995d056023a
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/923dea2a7ea9e1ef5ac4031fba461c1cc92e32b8
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/de769423b2f053182a41317c4db5a927e90622a0
Mailing List
Source: af854a3a-2127-422b-91ae-364da2661108
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusANALYZED
CWE
CWE-770

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card