CVE-2026-46086

A flaw was found in the Linux kernel. Inconsistent handling of local Forwarding Database (FDB) entries in the bridge networking component's RCU (Read-Copy-Update) readers can lead to a null-pointer dereference. A local attacker could exploit this by triggering a concurrent update to an FDB entry, causing the system to crash and resulting in a Denial of Service (DoS).

A race in Linux bridge FDB handling can let RCU readers observe different f dst values across a NULL check and a later dereference. A concurrent local FDB update can rewrite f dst to another port or NULL while the entry remains alive, which can make br_fdb_fillbuf or related bridge readers dereference a NULL port pointer and crash the kernel. For the CVSS the PR:L is used because reliable triggering generally requires a local process able to drive bridge or FDB state changes, for example through CAP_NET_ADMIN in a network namespace, rather than only remote packet delivery. The issue is not directly network reachable as a standalone remote attack. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.