PT-2026-43953 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-46086

Mitre

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: use a stable FDB dst snapshot in RCU readers

Local FDB entries can be rewritten in place by fdb delete local(), which updates f->dst to another port or to NULL while keeping the entry alive. Several bridge RCU readers inspect f->dst, including br fdb fillbuf() through the brforward read() sysfs path.

These readers currently load f->dst multiple times and can therefore observe inconsistent values across the check and later dereference. In br fdb fillbuf(), this means a concurrent local-FDB update can change f->dst after the NULL check and before the port no dereference, leading to a NULL-ptr-deref.

Fix this by taking a single READ ONCE() snapshot of f->dst in each affected RCU reader and using that snapshot for the rest of the access sequence. Also publish the in-place f->dst updates in fdb delete local() with WRITE ONCE() so the readers and writer use matching access patterns.

Related Identifiers

CVE-2026-46086

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46086 · Security Note
• https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5 · Note
• https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000ef · Note
• https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110 · Note
• https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808 · Note
• https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341f · Note