---
id: CVE-2026-52912
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_queue: hold bridge skb->dev while queued

  br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge
  master before queueing bridge LOCAL_IN …
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_queue: hold bridge skb->dev while queued

  br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge
  master before queueing bridge LOCAL_IN …
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-416
  - CWE-911
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 4.7, < 5.10.259'
  - 'linux_kernel >= 5.11, < 5.15.209'
  - 'linux_kernel >= 5.16, < 6.1.175'
  - 'linux_kernel >= 6.2, < 6.6.142'
  - 'linux_kernel >= 6.7, < 6.12.92'
  - 'linux_kernel >= 6.13, < 6.18.34'
  - 'linux_kernel >= 6.19, < 7.0.11'
  - linux_kernel = 7.1
patched:
  - linux_kernel 7.0.11
published: '2026-06-24'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T09:18:11.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52912'
references:
  - url: 'https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52912.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-52912'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2492105'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-52912'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52912'
  - url: >-
      https://lore.kernel.org/linux-cve-announce/2026062426-CVE-2026-52912-9506@gregkh/T
  - url: 'https://access.redhat.com/errata/RHSA-2026:71329'
  - url: 'https://access.redhat.com/errata/RHSA-2026:71700'
  - url: 'https://access.redhat.com/errata/RHSA-2026:71330'
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00152
epssPercentile: 0.03659
ingestedAt: '2026-09-08T13:33:25.029Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: hold bridge skb->dev while queued

br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge
master before queueing bridge LOCAL_IN packets. NFQUEUE only holds
references on state.in/out and bridge physdevs, so a queued bridge
packet can retain a freed bridge master in skb->dev until reinjection.

When the verdict is reinjected later, br_netif_receive_skb() re-enters
the receive path with skb->dev still pointing at the freed bridge master,
triggering a use-after-free.

Store skb->dev in the queue entry, hold a reference on it for the queue
lifetime, and use the saved device when dropping queued packets during
NETDEV_DOWN handling.

## Affected

- `linux_kernel >= 4.7, < 5.10.259`
- `linux_kernel >= 5.11, < 5.15.209`
- `linux_kernel >= 5.16, < 6.1.175`
- `linux_kernel >= 6.2, < 6.6.142`
- `linux_kernel >= 6.7, < 6.12.92`
- `linux_kernel >= 6.13, < 6.18.34`
- `linux_kernel >= 6.19, < 7.0.11`
- `linux_kernel = 7.1`

## Remediation

Upgrade past the affected range:

- `linux_kernel 7.0.11`

## Vendor advisories

- **RHSA-2026:71329** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71329)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52912.json)
- **RHSA-2026:71700** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-09-25 · [advisory](https://access.redhat.com/errata/RHSA-2026:71700)
- **RHSA-2026:71330** · Red Hat · fixed in: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8) · released 2026-09-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:71330)