Loading vulnerability…
CVE-2026-46086 is a race condition in the Linux kernel bridge networking subsystem affecting handling of forwarding database (FDB) destination pointers in RCU readers. Local FDB entries can be rewritten in place by fdb_delete_local(), which may change f->dst to another bridge port or to NULL while the FDB entry remains alive. Several bridge RCU readers inspect f->dst, including br_fdb_fillbuf() via the brforward_read() sysfs path. Because affected readers load f->dst multiple times, they can observe inconsistent values between an initial check and a later dereference. In br_fdb_fillbuf(), a concurrent local-FDB update can change f->dst after a NULL check but before dereferencing port_no, causing a kernel NULL-pointer dereference. The upstream fix changes affected readers to take a single READ_ONCE() snapshot of f->dst and use that stable value throughout the access sequence, while fdb_delete_local() publishes in-place updates with WRITE_ONCE() to match the reader access pattern.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
READ_ONCE() in affected bridge RCU readers and WRITE_ONCE() in fdb_delete_local() to prevent inconsistent observation of f->dst. Fixed upstream stable releases include 6.6.140, 6.12.86, 6.18.27, 7.0.4, and 7.1-rc1, with downstream fixes also shipped by vendors including Red Hat for supported RHEL 8, RHEL 9, and RHEL 10 kernel packages. Prefer updating to the latest supported stable kernel from the vendor rather than cherry-picking individual commits.No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vulnerability tracked as CVE-2026-46086 referenced in a Unity Linux local security check advisory.
A Linux kernel bridge networking flaw caused by inconsistent handling of local FDB entries in RCU readers, leading to a null-pointer dereference and local denial of service via kernel crash.
A Linux kernel vulnerability in the networking bridge code related to using a stable FDB destination snapshot in RCU readers.
A Linux kernel vulnerability in the networking bridge code related to using a stable FDB destination snapshot in RCU readers.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.