Executive brief
A vulnerability was identified in the Linux kernel's network bridging component, which manages how data packets are directed between different network segments. Under specific conditions, a race condition could occur when the system updates its internal forwarding database while simultaneously reading it. This can lead to a system crash (NULL pointer dereference), potentially resulting in a denial-of-service for the affected machine.
Technical details
A race condition exists in the Linux kernel bridge module due to unstable FDB destination (dst) snapshots in RCU readers. Local FDB entries can be rewritten in place by 'fdb_delete_local()', which updates 'f->dst' to another port or NULL. RCU readers such as 'br_fdb_fillbuf()' (accessed via sysfs) and 'br_do_proxy_suppress_arp()' load 'f->dst' multiple times. If a concurrent update changes 'f->dst' to NULL between a check and a subsequent dereference, a NULL pointer dereference occurs. The fix involves using 'READ_ONCE()' to take a stable snapshot of the destination pointer and 'WRITE_ONCE()' to ensure atomic updates.
Affected products
- Linux Foundation Linux kernel All versions prior to the fixed stable releases in May 2026
Timeline
- 2026-05-04: other: Initial patch authored
- 2026-05-27: advisory: CVE-2026-46086 published by NVD
- 2026-05-27: patched: Fixes merged into various stable kernel branches
References
- https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110
- https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5
- https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000ef
- https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341f
- https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808