Security tracker / CVE-2025-39872

CVE-2025-39872

hsr: hold rcu and dev lock for hsr_get_port_ndev

References

• Debian security tracker
• cve.org

Notes

 carnil> Introduced in 9c10dd8eed74 ("net: hsr: Create and export hsr_get_port_ndev()").
 carnil> Vulnerable versions: 6.12.63 6.14.

Bugs

Status

Branch	Status
upstream	released (6.17-rc6) [847748fc66d08a89135a74e29362a66ba4e3ab15]
6.18-upstream-stable	N/A "Fixed before branching point"
6.17-upstream-stable	N/A "Fixed before branching point"
6.16-upstream-stable	released (6.16.8) [68a6729afd3e8e9a2a32538642ce92b96ccf9b1d]
6.12-upstream-stable	needed
6.6-upstream-stable	N/A "Vulnerable code not present"
6.1-upstream-stable	N/A "Vulnerable code not present"
5.10-upstream-stable	N/A "Vulnerable code not present"
sid	released (6.16.8-1)
6.12-trixie-security	N/A "Vulnerable code not present"
6.1-bookworm-security	N/A "Vulnerable code not present"
5.10-bullseye-security	N/A "Vulnerable code not present"