CVE-2026-90106

A flaw was found in the Linux kernel's bridge ARP/ND (Address Resolution Protocol/Neighbor Discovery) proxy. When the neighbor hardware address (HA) is read directly, it can result in torn or partial reads if the neighbor entry is simultaneously being updated. This data inconsistency could lead to incorrect network state or unexpected behavior within the bridge module.

A moderate severity race condition flaw was found in the Linux kernel's bridge ARP/ND (Address Resolution Protocol/Neighbor Discovery) proxy. The bridge proxy code reads a neighbor entry's hardware address (neigh ha) directly rather than taking a stable snapshot, so if the neighbor entry is updated concurrently, the read can return a torn or partially updated address. This data inconsistency can lead to incorrect network state or unexpected behavior within the bridge module. Red Hat rates this flaw with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H): the impact is limited to availability, exploitation requires local access with privileges on the affected system, and there is no impact to confidentiality or integrity.

Red Hat Enterprise Linux 6 and 7, including their kernel-rt variants, are not affected because the vulnerable code is not present in those releases. The Red Hat Enterprise Linux 8, 9, and 10 kernels (including kernel-rt), the Red Hat In-Vehicle OS 2 kernel components, and the OpenShift Container Platform releases whose RHEL CoreOS images ship those kernels are affected. For the affected products the fix has been deferred: given the moderate rating, the local privileged position and narrow timing window required to trigger the race, and the absence of confidentiality or integrity impact, the correction is not being delivered in an immediate update and will be considered for a future one. The residual risk of the deferral is that bridge ARP/ND proxy configurations on affected kernels can still experience transient incorrect neighbor resolution or a loss of network availability if the race condition is hit.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.