In the Linux kernel, the following vulnerability has been resolved: hsr: broadcast netlink notifications in the device's net namespace The HSR generic netlink family sets .netnsok = true. HSR devices can live in network namespaces other than init_net. Two async notifiers broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper delivers only on the default genl socket in init_net. So the events always land in init_net. The network namespace of the device does not matter. This has two effects. A listener in the device's own namespace never sees its own ring error and node down events. A privileged listener in init_net receives events from HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave port ifindex (HSR_A_IFINDEX). Switch both callers to genlmsg_multicast_netns(). Other families with .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and handshake. hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown() takes the namespace from the master port via hsr_port_get_hsr().

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - hsr: broadcast netlink notifications in the device's net namespace The HSR generic netlink family sets     .netnsok = true. HSR devices can live in network namespaces other than init_net. Two async notifiers     broadcast events with genlmsg_multicast(). They are hsr_nl_ringerror() and hsr_nl_nodedown(). That helper     delivers only on the default genl socket in init_net. So the events always land in init_net. The network     namespace of the device does not matter. This has two effects. A listener in the device's own namespace     never sees its own ring error and node down events. A privileged listener in init_net receives events from     HSR devices in other namespaces. The payload carries the peer node MAC (HSR_A_NODE_ADDR) and the slave     port ifindex (HSR_A_IFINDEX). Switch both callers to genlmsg_multicast_netns(). Other families with     .netnsok = true already do this. Examples are gtp, ovpn, team, batman-adv, netdev-genl, ethtool and     handshake. hsr_nl_ringerror() already has the slave port. It uses dev_net(port->dev). hsr_nl_nodedown()     takes the namespace from the master port via hsr_port_get_hsr(). (CVE-2026-97419)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
365680	Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500385)	Nessus	Oracle Linux Local Security Checks	Local	medium
364137	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)	Nessus	Oracle Linux Local Security Checks	Local	high
362907	Debian dla-4817 : ata-modules-6.12.107+deb12-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
351155	Debian dsa-6528 : ata-modules-6.12.111+deb13-armmp-di - security update	Nessus	Debian Local Security Checks	Local	high
350041	Linux Distros Unpatched Vulnerability : CVE-2026-97419	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-97419

high

Tenable Plugins

medium

high

high

high

high