CVE-2026-46086

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.0.11-1.1

Description A flaw exists in the bridge component of the Linux kernel where local Forwarding Database (FDB) entries can be rewritten in place by the fdb delete local() function. This process updates the f->dst variable to another port or to NULL while the entry remains active. RCU readers, such as br fdb fillbuf() accessed via the brforward read() sysfs path, may load f->dst multiple times, leading to inconsistent values between the initial check and subsequent dereference. Specifically, a concurrent update can change f->dst to NULL after a check has been performed but before the port no dereference, resulting in a NULL-pointer dereference.

Recommendations Update to version 7.0.11-1.1.