CVE-2026-72255

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter nf queue component where NFQUEUE can keep a bridge private fake dst alive after the unregister process begins. This occurs because the br netfilter fake rtable is embedded in struct net bridge and attached to bridged packets via skb dst set noref(). When such a packet is queued to NFQUEUE, the nf queue() function upgrades that fake dst using skb dst force(), allowing the queued skb to hold a real dst reference even after bridge teardown has started.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.