CVE-2026-52912

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: nf_queue: hold bridge skb-&gt;dev while queued<br /> <br /> br_pass_frame_up() rewrites skb-&gt;dev from the ingress port to the bridge<br /> master before queueing bridge LOCAL_IN packets. NFQUEUE only holds<br /> references on state.in/out and bridge physdevs, so a queued bridge<br /> packet can retain a freed bridge master in skb-&gt;dev until reinjection.<br /> <br /> When the verdict is reinjected later, br_netif_receive_skb() re-enters<br /> the receive path with skb-&gt;dev still pointing at the freed bridge master,<br /> triggering a use-after-free.<br /> <br /> Store skb-&gt;dev in the queue entry, hold a reference on it for the queue<br /> lifetime, and use the saved device when dropping queued packets during<br /> NETDEV_DOWN handling.