The vulnerability originates in the Linux kernel’s HSR netlink subsystem. HSR devices that reside in network namespaces other than the initial namespace broadcast netlink notifications through the default generation socket within init_net. As a result, privileged listeners in init_net receive events generated by HSR devices in any namespace. Each event carries the peer node’s MAC address and the slave port interface index (‘HSR_A_NODE_ADDR’ and ‘HSR_A_IFINDEX’). The impact is a leakage of network‑topology details to privileged users; it is not a remote code execution flaw, but it exposes internal host information to root‑level observers.

Any system running a Linux kernel before the fix that includes the HSR module is affected. The bug is present regardless of the specific kernel release, as the description notes that HSR devices can live in arbitrary namespaces while the notifications are still broadcast from init_net. The vulnerability is therefore relevant to all affected Linux kernel versions until the kernel code is updated to use genlmsg_multicast_netns() for HSR notifications.

Exploitation requires a privileged process capable of listening to netlink messages in the init_net namespace; non‑privileged users cannot trigger the netlink broadcast. The CVSS score of 5.5 indicates a moderate severity and the EPSS score of < 1% suggests a low exploitation probability. The vulnerability is not listed in CISA KEV, indicating no confirmed public exploitation. Nonetheless, any root user can glean additional network information from other namespaces, which can aid further attacks. The moderate risk level reflects the information disclosure to privileged users rather than a privilege escalation or remote attack vector.