CVE-2026-46086: Linux Kernel Race Condition Vulnerability

CVE-2026-46086 Overview

CVE-2026-46086 is a NULL pointer dereference vulnerability in the Linux kernel's network bridge subsystem. The flaw resides in the forwarding database (FDB) handling code, specifically in how Read-Copy-Update (RCU) readers access the f->dst field of local FDB entries. Local FDB entries can be rewritten in place by fdb_delete_local(), which updates f->dst to another port or to NULL while keeping the entry alive. Concurrent readers such as br_fdb_fillbuf() reached through the brforward_read() sysfs path can observe inconsistent values across a check and a later dereference. This race condition can cause the kernel to dereference a NULL pointer, resulting in a kernel crash.

Critical Impact
A concurrent local-FDB update can change f->dst between the NULL check and the port_no dereference, triggering a NULL pointer dereference and kernel panic from an unprivileged read of bridge sysfs entries.

Affected Products

Linux kernel (mainline) with the net/bridge subsystem enabled
Distributions shipping vulnerable kernel versions prior to the fix commits listed by git.kernel.org/stable
Systems using Linux bridges for networking (containers, virtualization hosts, network appliances)

Discovery Timeline

2026-05-27 - CVE-2026-46086 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46086

Vulnerability Analysis

The Linux bridge driver maintains a forwarding database (FDB) of MAC address to port mappings. Local FDB entries (those representing addresses owned by the bridge itself) can be mutated in place rather than being replaced via RCU. The function fdb_delete_local() updates the destination pointer f->dst to either another port or NULL while the entry remains live and visible to RCU readers.

Readers including br_fdb_fillbuf(), which services the brforward_read() sysfs interface, load f->dst multiple times during a single access sequence. The first load is used for a NULL check; a subsequent load dereferences the pointer to access port_no. Without ordered access, the compiler is free to reissue the load, and a concurrent writer can change f->dst to NULL between the check and the dereference.

Root Cause

The root cause is the absence of paired READ_ONCE() and WRITE_ONCE() annotations on the f->dst field. Without these annotations, the compiler treats concurrent accesses as ordinary loads and stores, allowing tearing and reloads that break the check-then-use idiom typical in RCU readers. This is a classic data race producing a NULL pointer dereference [CWE-476] under concurrent execution.

Attack Vector

An attacker with local access who can read bridge sysfs files (such as /sys/class/net/<bridge>/brforward) while a local FDB entry is being modified can trigger the race. The window is narrow but reachable on systems that actively reconfigure bridge ports or MAC addresses. Successful exploitation produces a kernel oops and denial of service. The fix introduces a single READ_ONCE() snapshot of f->dst in each affected RCU reader and publishes in-place updates in fdb_delete_local() with WRITE_ONCE(), ensuring readers and writers use matching access patterns.

Detection Methods for CVE-2026-46086

Indicators of Compromise

Kernel oops or panic messages referencing br_fdb_fillbuf or brforward_read in dmesg or /var/log/kern.log
NULL pointer dereference stack traces originating from the net/bridge module
Unexpected loss of bridge connectivity following sysfs reads during FDB churn

Detection Strategies

Audit running kernel versions against the fixed commits published on git.kernel.org/stable to identify hosts requiring updates
Correlate dmesg crash signatures referencing bridge FDB functions with sysfs access events to identify exploitation attempts
Monitor process activity that opens /sys/class/net/*/brforward from unprivileged users on bridge-enabled hosts

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on bridge-related oops signatures
Track bridge configuration changes (port add/remove, FDB updates) alongside crash telemetry to identify race triggers
Monitor uptime and unexpected reboots on virtualization hosts and container nodes that rely on Linux bridges

How to Mitigate CVE-2026-46086

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable tree commits 0b9e4bbf, 5424e678, 81af4137, 9a2d9d4e, and df460165
Update to a distribution kernel that incorporates the fix once vendor packages are released
Restrict access to bridge sysfs entries on multi-tenant hosts until patches are deployed

Patch Information

The fix is published across multiple stable branches. Refer to the commits at Kernel Git Commit 0b9e4bbf, Kernel Git Commit 5424e678, Kernel Git Commit 81af4137, Kernel Git Commit 9a2d9d4e, and Kernel Git Commit df460165. The patch adds READ_ONCE() snapshots in RCU readers and WRITE_ONCE() updates in fdb_delete_local().

Workarounds

Limit read access to /sys/class/net/<bridge>/brforward to privileged users only via filesystem permissions or mandatory access control policies
Avoid frequent dynamic reconfiguration of bridge ports and local FDB entries on production hosts until patched
Where feasible, replace Linux bridges with alternative forwarding mechanisms (Open vSwitch, macvlan) on critical hosts until kernels are updated

bash

# Verify the running kernel version and check for the fix
uname -r

# Restrict sysfs bridge forwarding table reads to root
chmod 600 /sys/class/net/*/brforward

# Apply the latest stable kernel update via the distribution package manager
# Debian/Ubuntu:
sudo apt update && sudo apt upgrade linux-image-generic

# RHEL/Rocky/AlmaLinux:
sudo dnf update kernel

# Reboot to load the patched kernel
sudo systemctl reboot