CVE-2026-52912

netfilter: nf_queue: hold bridge skb->dev while queued

State: Published
Severity: 7.8 High
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: hold bridge skb->dev while queued

br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection.

When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free.

Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	ac28634456867b23b95faccba7997a62ec430603 to before 950d809f154dca04e5fbe5d3c8b9c5e44769cd57Affected ac28634456867b23b95faccba7997a62ec430603 to before a698ac8ab2561cf575d2d9f34095032651dd952eAffected ac28634456867b23b95faccba7997a62ec430603 to before 19924bdd8a45ebc72a7b84c57fd63057d1dc75acAffected ac28634456867b23b95faccba7997a62ec430603 to before 1e5e20031c5eee8d2e490a90ff4d6a2feecfc3beAffected ac28634456867b23b95faccba7997a62ec430603 to before 3823c27099cfe2482299065814adbaa771be9644Affected ac28634456867b23b95faccba7997a62ec430603 to before 15d464265120ab9818bd673af301deee09bedab2Affected ac28634456867b23b95faccba7997a62ec430603 to before 3fb0f5c0f64162a8c3f25616a4f1e340b921737fAffected ac28634456867b23b95faccba7997a62ec430603 to before e196115ec330a18de415bdb9f5071aa9f08e53ceAffected
LinuxLinux	4.7Affected before 4.7Not affected 5.10.259 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

ac28634456867b23b95faccba7997a62ec430603 to before 950d809f154dca04e5fbe5d3c8b9c5e44769cd57Affected
ac28634456867b23b95faccba7997a62ec430603 to before a698ac8ab2561cf575d2d9f34095032651dd952eAffected
ac28634456867b23b95faccba7997a62ec430603 to before 19924bdd8a45ebc72a7b84c57fd63057d1dc75acAffected
ac28634456867b23b95faccba7997a62ec430603 to before 1e5e20031c5eee8d2e490a90ff4d6a2feecfc3beAffected
ac28634456867b23b95faccba7997a62ec430603 to before 3823c27099cfe2482299065814adbaa771be9644Affected
ac28634456867b23b95faccba7997a62ec430603 to before 15d464265120ab9818bd673af301deee09bedab2Affected
ac28634456867b23b95faccba7997a62ec430603 to before 3fb0f5c0f64162a8c3f25616a4f1e340b921737fAffected
ac28634456867b23b95faccba7997a62ec430603 to before e196115ec330a18de415bdb9f5071aa9f08e53ceAffected

LinuxLinux

4.7Affected
before 4.7Not affected
5.10.259 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.