CVE-2026-90106net: bridge: arp/nd proxy: fix reading neigh ha
- —Not scoredno CVSS score yet
- 0.23%Exploitation in 30 daysEPSS · top 86% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 43 days later
· 43 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 057658cb33fbf4d4309f01fe8845903b1cd07fad – < 2365b25b4add42bb5f652920b45bc9ad0e35cbc7
- affected 057658cb33fbf4d4309f01fe8845903b1cd07fad – < 490c72868443ff90f47f4ccbaaff1eaf8fed46ab
- affected 057658cb33fbf4d4309f01fe8845903b1cd07fad – < a178bcb01051688fb085ffb72cc4b13b5df0fc0f
- affected 057658cb33fbf4d4309f01fe8845903b1cd07fad – < 884cbf15ccd3980bcc9583073045f91798a86d4e
- affected 057658cb33fbf4d4309f01fe8845903b1cd07fad – < 291c9e137b7c74e8a512cded4845352da4c4adda
- affected 057658cb33fbf4d4309f01fe8845903b1cd07fad – < 57549ab9079122991dfa0f8248ca00e101e8e69b
- affected 4.15
- unaffected < 4.15
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References6
- https://git.kernel.org/stable/c/2365b25b4add42bb5f652920b45bc9ad0e35cbc7 (opens in a new tab)
- https://git.kernel.org/stable/c/490c72868443ff90f47f4ccbaaff1eaf8fed46ab (opens in a new tab)
- https://git.kernel.org/stable/c/a178bcb01051688fb085ffb72cc4b13b5df0fc0f (opens in a new tab)
- https://git.kernel.org/stable/c/884cbf15ccd3980bcc9583073045f91798a86d4e (opens in a new tab)
- https://git.kernel.org/stable/c/291c9e137b7c74e8a512cded4845352da4c4adda (opens in a new tab)
- https://git.kernel.org/stable/c/57549ab9079122991dfa0f8248ca00e101e8e69b (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-81699 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-90106)Record last updated .