REDHAT-BUG-2481989: Medium severity The Linux Kernel Community Linux Kernel vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net: bridge: use a stable FDB dst snapshot in RCU readers

Local FDB entries can be rewritten in place by fdbdeletelocal(), which updates f->dst to another port or to NULL while keeping the entry alive. Several bridge RCU readers inspect f->dst, including brfdbfillbuf() through the brforwardread() sysfs path.

These readers currently load f->dst multiple times and can therefore observe inconsistent values across the check and later dereference. In brfdbfillbuf(), this means a concurrent local-FDB update can change f->dst after the NULL check and before the portno dereference, leading to a NULL-ptr-deref.

Fix this by taking a single READONCE() snapshot of f->dst in each affected RCU reader and using that snapshot for the rest of the access sequence. Also publish the in-place f->dst updates in fdbdeletelocal() with WRITEONCE() so the readers and writer use matching access patterns.