Loading story…
A flaw tracked as CVE-2026-46086 in the Linux kernel's bridge networking component can let a low-privileged local attacker crash a system by triggering a race in forwarding database (FDB) handling. The bug stems from RCU readers loading the FDB destination pointer multiple times while concurrent updates can rewrite that pointer in place, allowing br_fdb_fillbuf() to pass a NULL check and later dereference a NULL pointer. Red Hat rated the issue Moderate with a CVSS v3.1 score of 5.5, classifying it as a CWE-367 time-of-check time-of-use race condition with denial-of-service impact only.
Upstream kernel maintainers fixed the issue by taking a stable snapshot of f->dst with READ_ONCE() in affected RCU readers and using WRITE_ONCE() for in-place updates in fdb_delete_local(). The vulnerability was introduced in kernel 3.14 and patched in stable releases including 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1. Red Hat said fixes are available for RHEL 8 kernel and kernel-rt, RHEL 9 kernel, and RHEL 10 kernel, while RHEL 7 kernel, **RHEL 7 kernel-rt`, and RHEL 9 kernel-rt remain affected; RHEL 6 is out of support and should be assumed vulnerable.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued RHSA-2026:47017 on 2026-07-28 to fix CVE-2026-46086 in the Red Hat Enterprise Linux 10 kernel.
On 2026-07-14, Red Hat issued RHSA-2026:39179 for the RHEL 8 kernel and RHSA-2026:39180 for the RHEL 8 kernel-rt to address CVE-2026-46086.
Red Hat's CVE entry for CVE-2026-46086 was last modified on 2026-07-13, reflecting updated status information for affected and fixed products.
Red Hat issued RHSA-2026:38491 on 2026-07-13 to fix CVE-2026-46086 in the Red Hat Enterprise Linux 9 kernel.
Red Hat published its advisory entry for CVE-2026-46086 on 2026-05-27, classifying the Linux kernel flaw as Moderate severity with denial-of-service impact.
On 2026-05-27, the Linux kernel CVE team publicly described CVE-2026-46086 as a bridge subsystem race condition that can cause a NULL-pointer dereference, and outlined the READ_ONCE/WRITE_ONCE-based fix approach.
The vulnerability tracked as CVE-2026-46086 was introduced in Linux kernel 3.14 by commit 960b589f86c74ce582922fcb996103271081f4de, affecting bridge networking code.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A race condition in the Linux kernel IPv6 networking stack, tracked as **CVE-2022-3524**, can allow a local low-privileged user to crash an affected system. The flaw occurs when `IPV6_ADDRFORM` converts a socket from IPv6 to IPv4 while another operation processes `IPV6_DSTOPTS`, creating unsafe concurrent access to the socket protocol-handler pointer and causing a memory leak that can result in denial of service. Red Hat rates the issue **CVSS 5.5 (Moderate)**; confidentiality and integrity are unaffected, but availability impact is high. The upstream kernel fix hardens access to `sk->sk_prot` by replacing direct reads with `READ_ONCE()` in common socket-option handling and IPv4 datagram connection, accept, and sendpage paths, pairing them with the existing `WRITE_ONCE()` used during IPv6-to-IPv4 conversion. Red Hat released corrected kernel packages for affected RHEL 8 and RHEL 9 variants, including RHEL 8.6 Extended Update Support; RHEL 6 and 7 kernel packages are outside support scope.
Aug 26, 2026
**CVE-2022-3623** is a moderate-severity Linux kernel flaw in `follow_page_pte` within `mm/gup.c`. A race condition can poison a page-table entry, enabling a local, low-privileged attacker to trigger denial of service. The defect is classified as **CWE-123** (write-what-where condition), a memory-corruption weakness that can permit arbitrary memory modification and, in some cases, code execution or privilege escalation. The issue was fixed upstream in Linux 6.1-rc1. Red Hat released corrected `kernel` and `kernel-rt` packages for affected RHEL 8 and RHEL 9 systems, including RHEL 8.6 EUS and Red Hat Virtualization 4 for RHEL 8; RHEL 6 and RHEL 7 kernel variants were not affected. Red Hat assigned CVSS 3.1 score **5.8** and stated that no qualifying mitigation was available, making deployment of vendor updates the recommended remediation.
Aug 26, 2026
A flaw tracked as **CVE-2025-37861** affects the Linux kernel's `scsi: mpi3mr` driver, where improper synchronization between the reset thread and the task management thread can expose an invalid reply queue ID of `0xFFFF` during controller reset. That race can cause the task management path to reference unallocated memory and trigger a kernel crash, making the issue a denial-of-service risk. Red Hat rated the bug **Moderate** with a **CVSS 6.3**, while NVD and CVE.org scored it **7.8**; Red Hat said exploitation requires local access with a special group privilege and noted no integrity impact in the known use case. Upstream Linux fixed the bug by adding an `io_admin_reset_sync` flag to coordinate reset, I/O, and admin thread access to reply queues, block processing during reset, and mark the controller unrecoverable if synchronization does not complete within 10 seconds. The Linux kernel CVE team said the issue is resolved in versions **6.12.24**, **6.13.12**, **6.14.3**, and **6.15-rc1**, and advised users to move to the latest stable kernel release. Red Hat also shipped fixes across multiple **Red Hat Enterprise Linux 9** variants, including `kernel-rt` updates in advisory **RHSA-2026:3358**, while stating **RHEL 10** is affected and **RHEL 6** and **RHEL 7** kernel packages are not affected because the vulnerable code is absent.
Aug 25, 2026