CVE-2025-39872

What it actually does

Use-after-free in the Linux kernel HSR driver because hsr_get_port_ndev fails to hold the RCU lock during hsr_for_each_port iteration and does not retain a device reference before returning the port net_device, allowing concurrent removal to free the object while the caller still uses it.

Why it matters to the business

Systems relying on HSR for high-availability networking face kernel crashes, potential local privilege escalation, or denial of service; the issue affects industrial control, telecom, and other environments using the Linux kernel's HSR implementation.

How an attack unfolds

An attacker with local access triggers concurrent HSR port operations (add/remove or netdevice events) while hsr_get_port_ndev runs without proper RCU and reference protection, causing the caller to dereference a freed net_device and enabling memory corruption that can be turned into code execution or a crash.

How to fix it

Upgrade the Linux kernel to version 6.12.64 or later, or apply commit 9433ba79c2ec3ec7c9a711748701549339c3438c from the stable git tree; rebuild and reboot with the patched kernel on all affected hosts.

How to confirm the fix worked

Verify the running kernel version is at least 6.12.64, confirm the source tree contains the referenced commit, and inspect hsr_get_port_ndev to ensure rcu_read_lock and dev_hold are acquired before the port iteration and reference return.

Typical attack path

1. Obtain local execution on a system using the HSR protocol
2. Race HSR port addition/removal operations against calls to hsr_get_port_ndev
3. Trigger use-after-free of the net_device structure
4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for HSR-related oops, use-after-free warnings, or netdevice reference errors around the time of suspected exploitation; correlate with processes performing HSR configuration changes.

What your security team should do

• Prioritize kernel upgrades on all systems exposing HSR interfaces
• Audit environments for HSR usage and schedule staged rollouts
• Monitor vendor and distribution advisories for backported fixes in older LTS kernels