CVE-2026-52912

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the netfilter nf queue component. The br pass frame up() function rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL IN packets. Because NFQUEUE only holds references on state.in/out and bridge physdevs, a queued bridge packet may retain a reference to a freed bridge master in skb->dev until reinjection. When the verdict is later reinjected, br netif receive skb() re-enters the receive path while skb->dev still points to the freed bridge master, leading to the use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.