{"id":"CVE-2026-52912","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb->dev while queued\n\nbr_pass_frame_up() rewrites skb->dev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN …","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb->dev while queued\n\nbr_pass_frame_up() rewrites skb->dev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-416","CWE-911"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 4.7, < 5.10.259","linux_kernel >= 5.11, < 5.15.209","linux_kernel >= 5.16, < 6.1.175","linux_kernel >= 6.2, < 6.6.142","linux_kernel >= 6.7, < 6.12.92","linux_kernel >= 6.13, < 6.18.34","linux_kernel >= 6.19, < 7.0.11","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.11"],"published":"2026-06-24","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:19:56.100","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-52912","references":[{"url":"https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52912.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-52912"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2492105"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-52912"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52912"},{"url":"https://lore.kernel.org/linux-cve-announce/2026062426-CVE-2026-52912-9506@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:71329"},{"url":"https://access.redhat.com/errata/RHSA-2026:71700"},{"url":"https://access.redhat.com/errata/RHSA-2026:71330"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00157,"epssPercentile":0.04792,"ingestedAt":"2026-09-08T13:33:25.029Z","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:22:30.377062Z"},"slug":"CVE-2026-52912","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb->dev while queued\n\nbr_pass_frame_up() rewrites skb->dev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN packets. NFQUEUE only holds\nreferences on state.in/out and bridge physdevs, so a queued bridge\npacket can retain a freed bridge master in skb->dev until reinjection.\n\nWhen the verdict is reinjected later, br_netif_receive_skb() re-enters\nthe receive path with skb->dev still pointing at the freed bridge master,\ntriggering a use-after-free.\n\nStore skb->dev in the queue entry, hold a reference on it for the queue\nlifetime, and use the saved device when dropping queued packets during\nNETDEV_DOWN handling.\n\n## Affected\n\n- `linux_kernel >= 4.7, < 5.10.259`\n- `linux_kernel >= 5.11, < 5.15.209`\n- `linux_kernel >= 5.16, < 6.1.175`\n- `linux_kernel >= 6.2, < 6.6.142`\n- `linux_kernel >= 6.7, < 6.12.92`\n- `linux_kernel >= 6.13, < 6.18.34`\n- `linux_kernel >= 6.19, < 7.0.11`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.11`\n\n## Vendor advisories\n\n- **RHSA-2026:71329** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71329)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52912.json)\n- **RHSA-2026:71700** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:71700)\n- **RHSA-2026:71330** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71330)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}