7.8 High

CVE-2026-52912 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while…

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection. When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free. Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling.

Affected products and versions

Product	Affected versions	Fixed in
Linux 7.1	earliest → < 7.1	7.1
Linux 7.0	earliest → < 7.0.11	7.0.11
Linux 6.18	earliest → < 6.18.34	6.18.34
Linux 6.12	earliest → < 6.12.92	6.12.92
Linux 6.6	earliest → < 6.6.142	6.6.142
Linux 6.1	earliest → < 6.1.175	6.1.175
Linux 5.15	earliest → < 5.15.209	5.15.209
Linux 5.10	earliest → < 5.10.259	5.10.259
Linux	4.7	No fix stated

Show the 3 other branches

Product	Affected versions	Fixed in
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1	3.1.7 → latest	No fix stated