The vulnerability in the Linux kernel's HSR subsystem arises because generic-netlink operations that read the node list and node status run under rcu_read_lock(), traversing the node database via hsr_get_next_node() and hsr_get_node_data(). However, the RTM_DELLINK teardown path removes the node table using list_del() and immediately frees each node, which can cause a use-after-free condition if a generic-netlink reader holds a pointer to a node during hsr_dellink(). In KASAN builds, this manifests as a slab-use-after-free when the reader accesses node->macaddress_A. The fix involves replacing list_del() with list_del_rcu() and deferring node freeing through the hsr_free_node_rcu() callback, aligning with existing lifetime management in HSR prune paths that use list_del_rcu() and call_rcu().

This vulnerability can lead to use-after-free memory corruption in the Linux kernel's HSR networking code, potentially causing kernel crashes or undefined behavior. There is no indication of known exploits in the wild. The issue affects kernel memory safety under specific conditions involving concurrent access to HSR node data during link teardown.

A fix has been implemented that changes the node removal process to use list_del_rcu() and defers freeing nodes until after RCU readers complete via the hsr_free_node_rcu() callback. Users should update to Linux kernel versions that include this fix once available. Patch status is not yet confirmed; check the vendor advisory or Linux kernel mailing lists for the specific fixed versions and remediation guidance.