CVE-2026-46086

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: bridge: use a stable FDB dst snapshot in RCU readers<br /> <br /> Local FDB entries can be rewritten in place by `fdb_delete_local()`, which<br /> updates `f-&gt;dst` to another port or to `NULL` while keeping the entry<br /> alive. Several bridge RCU readers inspect `f-&gt;dst`, including<br /> `br_fdb_fillbuf()` through the `brforward_read()` sysfs path.<br /> <br /> These readers currently load `f-&gt;dst` multiple times and can therefore<br /> observe inconsistent values across the check and later dereference.<br /> In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change<br /> `f-&gt;dst` after the NULL check and before the `port_no` dereference,<br /> leading to a NULL-ptr-deref.<br /> <br /> Fix this by taking a single `READ_ONCE()` snapshot of `f-&gt;dst` in each<br /> affected RCU reader and using that snapshot for the rest of the access<br /> sequence. Also publish the in-place `f-&gt;dst` updates in `fdb_delete_local()`<br /> with `WRITE_ONCE()` so the readers and writer use matching access patterns.