This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-90106 →

DEBIAN-CVE-2026-90106

In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is re...

Original description

The description as published by the source.

In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 linux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.6-1"}]}]

References

advisory security-tracker.debian.org