High 7.8Published Jun 24, 2026

CVE-2026-52912netfilter: nf_queue: hold bridge skb->dev while queued

Updated under an hour ago (Oct 27, 2026, 8:20 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection. When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free. Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ac28634456867b23b95faccba7997a62ec430603 before 950d809f154dca04e5fbe5d3c8b9c5e44769cd57; from ac28634456867b23b95faccba7997a62ec430603 before a698ac8ab2561cf575d2d9f34095032651dd952e; from ac28634456867b23b95faccba7997a62ec430603 before 19924bdd8a45ebc72a7b84c57fd63057d1dc75ac; from ac28634456867b23b95faccba7997a62ec430603 before 1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be; from ac28634456867b23b95faccba7997a62ec430603 before 3823c27099cfe2482299065814adbaa771be9644; from ac28634456867b23b95faccba7997a62ec430603 before 15d464265120ab9818bd673af301deee09bedab2; from ac28634456867b23b95faccba7997a62ec430603 before 3fb0f5c0f64162a8c3f25616a4f1e340b921737f; from ac28634456867b23b95faccba7997a62ec430603 before e196115ec330a18de415bdb9f5071aa9f08e53ce	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.7 before 5.10.259; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 3 more ranges	NVD

References

References

https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57	patch
https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e	patch
https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac	patch
https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be	patch
https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644	patch
https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2	patch
https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f	patch
https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.