CVE-2026-68301: net: hsr: fix memory leak on slave unregistration by removing synced VLANs

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: hsr: fix memory leak on slave unregistration by removing synced VLANs

When an HSR master device is brought UP, it auto-adds VLAN 0 via
vlan_vid0_add(), which propagates VID 0 to its slave devices (slave A and B).

If a slave device is later unregistered while HSR is active (e.g., during
netns cleanup or interface destruction), hsr_del_port() is called to
detach the slave port from the HSR master. However, hsr_del_port() currently
does not delete the VLAN IDs that were synced to the slave device by HSR.

As a result, the slave device retains a refcount on VID 0 (and any other
synced VLANs). When the slave device is destroyed, its vlan_info /
vlan_vid_info structure remains allocated, leading to a memory leak.

Fix this by calling vlan_vids_del_by_dev(port->dev, master->dev) in
hsr_del_port() before unlinking slave A or slave B ports, matching the
propagation logic in hsr_ndo_vlan_rx_add_vid() / hsr_ndo_vlan_rx_kill_vid()
and the cleanup behavior in bonding and team drivers.

The Linux kernel CVE team has assigned CVE-2026-68301 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.6.107 with commit 72dbae1f2f2159395089405c6c54632f2613f1be and fixed in 6.6.148 with commit f72c312af6c7897ab0f8a2b5a63f917a207a4143
	Issue introduced in 6.12.48 with commit c707d2c5541d2bb94131968ad5dfeb06427a1dba and fixed in 6.12.101 with commit 21d48408479a17eb65568a765930adea37e4d804
	Issue introduced in 6.13 with commit 1a8a63a5305e95519de6f941922dfcd8179f82e5 and fixed in 6.18.42 with commit b5ded444621b6180df9f3d4e07045fc1fc1e8cd9
	Issue introduced in 6.13 with commit 1a8a63a5305e95519de6f941922dfcd8179f82e5 and fixed in 7.1.6 with commit ae995b8002d3af134560a706c0e111a89e26317c
	Issue introduced in 6.13 with commit 1a8a63a5305e95519de6f941922dfcd8179f82e5 and fixed in 7.2-rc5 with commit dcf15eaf5641812f1cfc5e96537380132a7da89d
	Issue introduced in 5.15.194 with commit 1100242709d5644856131a9dd25d32672ebe7357
	Issue introduced in 6.1.153 with commit a2accc07bdcfb0c7ab2cacdca6a1fe8267816efa

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68301
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/hsr/hsr_slave.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f72c312af6c7897ab0f8a2b5a63f917a207a4143
	https://git.kernel.org/stable/c/21d48408479a17eb65568a765930adea37e4d804
	https://git.kernel.org/stable/c/b5ded444621b6180df9f3d4e07045fc1fc1e8cd9
	https://git.kernel.org/stable/c/ae995b8002d3af134560a706c0e111a89e26317c
	https://git.kernel.org/stable/c/dcf15eaf5641812f1cfc5e96537380132a7da89d