The High-Speed Redundancy (HSR) driver contains a WARN_ONCE() check in hsr_addr_is_self() that is triggered when a network link is being removed. During unlinking, hsr->self_node is cleared before the link deletion completes, creating a race window where the warning may fire. The warning itself signals an incorrect assumption, but there is no documented evidence of memory corruption, privilege escalation, or denial-of-service; the impact is simply the generation of a log message.

All Linux kernel versions that include the unpatched HSR driver are affected; the specific kernel releases are not enumerated in the data, so any build with the original hsr_addr_is_self() implementation remains at risk.

With a CVSS score of 5.5 and an EPSS score of < 1%, the likelihood of publicly available exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require privileged local access to delete a network link or otherwise manipulate HSR state. While the risk to production systems is low, the presence of a race condition is a potential reliability concern.