Medium 5.5Published May 27, 2026

CVE-2026-46086net: bridge: use a stable FDB dst snapshot in RCU readers

Updated under an hour ago (Oct 27, 2026, 1:30 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use a stable FDB dst snapshot in RCU readers Local FDB entries can be rewritten in place by `fdb_delete_local()`, which updates `f->dst` to another port or to `NULL` while keeping the entry alive. Several bridge RCU readers inspect `f->dst`, including `br_fdb_fillbuf()` through the `brforward_read()` sysfs path. These readers currently load `f->dst` multiple times and can therefore observe inconsistent values across the check and later dereference. In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change `f->dst` after the NULL check and before the `port_no` dereference, leading to a NULL-ptr-deref. Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each affected RCU reader and using that snapshot for the rest of the access sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()` with `WRITE_ONCE()` so the readers and writer use matching access patterns.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 960b589f86c74ce582922fcb996103271081f4de before c502fa9f094cb03d1d1685c71e2105ab359bc2b8; from 960b589f86c74ce582922fcb996103271081f4de before a6ae4511c07b91f597e461406c6330f0d4ff810e; from 960b589f86c74ce582922fcb996103271081f4de before 1406c4e0ed1eaf8a29801ab1163d00fb7ee4359a; 960b589f86c74ce582922fcb996103271081f4de builds before 0b9e4bbfb7c949151e3acd44ed4aa33614d2e110; 960b589f86c74ce582922fcb996103271081f4de builds before 81af4137a30c4c2dc694dea8cacb180bd66000ef; from 960b589f86c74ce582922fcb996103271081f4de before 5424e678f9b304e148cf5dcc047cffc7a56a3bb5; 960b589f86c74ce582922fcb996103271081f4de builds before 9a2d9d4e657b23dc21f24cf139e3aeff0b61341f; from 960b589f86c74ce582922fcb996103271081f4de before df4601653201de21b487c3e7fffd464790cab808	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 3.14.1 before 5.10.259; from 5.11 before 5.15.210; from 5.16 before 6.1.176; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4; 3.14; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/c502fa9f094cb03d1d1685c71e2105ab359bc2b8	patch
https://git.kernel.org/stable/c/a6ae4511c07b91f597e461406c6330f0d4ff810e	patch
https://git.kernel.org/stable/c/1406c4e0ed1eaf8a29801ab1163d00fb7ee4359a	patch
https://git.kernel.org/stable/c/0b9e4bbfb7c949151e3acd44ed4aa33614d2e110	patch
https://git.kernel.org/stable/c/81af4137a30c4c2dc694dea8cacb180bd66000ef	patch
https://git.kernel.org/stable/c/5424e678f9b304e148cf5dcc047cffc7a56a3bb5	patch
https://git.kernel.org/stable/c/9a2d9d4e657b23dc21f24cf139e3aeff0b61341f	patch
https://git.kernel.org/stable/c/df4601653201de21b487c3e7fffd464790cab808	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.