CVE-2026-52912: netfilter: nf_queue: hold bridge skb->dev while queued
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfqueue: hold bridge skb->dev while queued
brpassframeup() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCALIN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection.
When the verdict is reinjected later, brnetifreceiveskb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free.
Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEVDOWN handling.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52912?
CVE-2026-52912 has a severity rating of high, with a score of 7.8.
How does CVE-2026-52912 affect the Linux kernel?
CVE-2026-52912 can lead to a use-after-free condition in the Linux kernel, impacting netfilter's nf_queue functionality.
How do I fix CVE-2026-52912?
To fix CVE-2026-52912, you should update the Linux kernel to the latest version that contains the security patch.
What systems are vulnerable to CVE-2026-52912?
CVE-2026-52912 primarily affects the Linux kernel and Microsoft azl3 kernel versions prior to the patch.
What types of attacks could exploit CVE-2026-52912?
An attacker could exploit CVE-2026-52912 to execute arbitrary code or cause denial of service conditions due to the use-after-free vulnerability.