Executive brief
The Linux kernel's bridge networking code contains a race condition when reading neighbor hardware addresses during ARP and ND (Neighbor Discovery) proxy operations. When a neighbor entry is being updated concurrently, the code could read a torn or partial address, potentially causing incorrect packet forwarding or system instability. This affects systems using bridge networking with neighbor suppression enabled.
Technical details
A data race condition exists in the bridge ARP/ND proxy code (net/bridge/br_arp_nd_proxy.c) where neighbor hardware addresses (neigh->ha) are read directly without synchronization. Concurrent updates to the neighbor entry can result in torn or partial reads of the 6-byte Ethernet address. The fix uses neigh_ha_snapshot() to atomically capture a stable snapshot of the address before use in ARP and ND packet generation. This is a concurrency issue with no known remote exploit vector, as it requires specific timing conditions in bridge proxy operations. Patches have been merged into the stable kernel branches.
Affected products
- Linux Linux kernel Multiple versions across 2.6.11 through 7.2 (see stable branches)
Timeline
- 2026-09-17: disclosed
- 2026-08-18: patched: Upstream commit authored; merged to stable branches by 2026-09-14