CVE-2026-97419

In the Linux kernel, the following vulnerability has been resolved:

hsr: broadcast netlink notifications in the device's net namespace

The HSR generic netlink family sets .netnsok = true. HSR devices can

live in network namespaces other than init_net.

Two async notifiers broadcast events with genlmsg_multicast(). They

are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers

only on the default genl socket in init_net. So the events always land

in init_net. The network namespace of the device does not matter.

This has two effects. A listener in the device's own namespace never

sees its own ring error and node down events. A privileged listener in

init_net receives events from HSR devices in other namespaces. The

payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port

ifindex (HSR_A_IFINDEX).

Switch both callers to genlmsg_multicast_netns(). Other families with

.netnsok = true already do this. Examples are gtp, ovpn, team,

batman-adv, netdev-genl, ethtool and handshake.

hsr_nl_ringerror() already has the slave port. It uses

dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the

master port via hsr_port_get_hsr().