PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46086 Linux CVE debrief

A race condition in the Linux kernel's network bridge forwarding database (FDB) implementation can lead to a NULL pointer dereference. The vulnerability exists because RCU readers in the bridge subsystem load the `f->dst` field multiple times without proper synchronization, allowing a concurrent update via `fdb_delete_local()` to change the value between a NULL check and subsequent dereference. Specifically, `br_fdb_fillbuf()` accessed through the `brforward_read()` sysfs path is affected. The fix introduces `READ_ONCE()` snapshots for RCU readers and `WRITE_ONCE()` for the writer to ensure consistent access patterns.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Linux system administrators running bridge networking configurations, kernel maintainers, and security teams monitoring network subsystem vulnerabilities. Organizations using container networking, virtualization platforms, or software-defined networking that relies on Linux bridge functionality should prioritize patching.

Technical summary

The Linux kernel's bridge forwarding database (FDB) subsystem contains a race condition where RCU readers perform multiple loads of `f->dst` without atomic guarantees. The `fdb_delete_local()` function can rewrite local FDB entries in-place, updating `f->dst` to another port or NULL while the entry remains alive. Readers such as `br_fdb_fillbuf()` (exposed via `brforward_read()` sysfs) check `f->dst` for NULL then dereference it for `port_no`, but a concurrent update can invalidate this check. The resolution uses `READ_ONCE()` to capture stable snapshots in readers and `WRITE_ONCE()` to publish updates, ensuring consistent memory access ordering between writers and RCU readers.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches once patches are available for your distribution
  • Monitor vendor security advisories for backported fixes to long-term support kernels
  • Review systems using bridge networking with sysfs FDB access paths
  • Consider restricting access to /sys/class/net/*/brforward to reduce attack surface
  • Validate kernel versions against fixed commits in stable trees

Evidence notes

The vulnerability description is sourced from the official CVE record published 2026-05-27. The fix involves kernel commits to stable branches, with five reference links provided to git.kernel.org stable commits. No CVSS score or severity rating has been assigned as of the modified date (2026-05-27T14:48:03Z). The vendor is identified as the Linux kernel project based on source domain evidence.

Official resources

2026-05-27