CVE-2026-52912: Linux Kernel Bridge NFQUEUE Use-After-Free Privilege Escalation

Technical summary

CVE-2026-52912 is a use-after-free flaw (CWE-416) in the Linux kernel's netfilter nf_queue subsystem affecting bridge (br_*) packet handling. The vulnerability occurs because br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queuing LOCAL_IN packets. The queue entry holds references only on state.in/out and bridge physical devices, not the bridge master itself. When a queued bridge packet is reinjected after the bridge has been destroyed, br_netif_receive_skb() re-enters the receive path with skb->dev pointing to freed memory. The fix stores skb->dev in the queue entry, maintains a reference for the queue's lifetime, and uses the saved device during NETDEV_DOWN cleanup to prevent dangling pointers.

Business impact

This vulnerability affects systems using Linux kernel with netfilter and bridge forwarding enabled—common in container orchestration, network appliances, and multi-tenant virtualization environments. Successful exploitation by a local attacker with network namespace privileges can crash the kernel (denial of service) or potentially execute arbitrary code in kernel context. Organizations relying on bridge-based network segmentation or packet filtering should prioritize patching to maintain system stability and prevent lateral movement through network isolation bypass.

Affected systems

The Linux kernel is affected across multiple versions. The vulnerability specifically impacts configurations where netfilter NFQUEUE and Linux bridge forwarding are both active. This is typical in Kubernetes nodes, OpenStack compute hosts, and systems using iptables/nftables with packet queuing rules on bridged interfaces. Both the ingress port and bridge master device must be present for the vulnerable code path to execute.

Exploitability

Exploitation requires local access (AV:L) and unprivileged user-level privileges (PR:L) but no user interaction. An attacker must be able to configure bridge interfaces and queue packets, typically via network namespace or container escape scenarios. The attack is straightforward once prerequisites are met: trigger bridge packet queuing, destroy the bridge, and reinject the queued packet. No special timing or race conditions are required, making this a reliable exploit vector for local privilege escalation.

Remediation

Apply the Linux kernel patch that modifies nf_queue to store and reference-count skb->dev throughout the queue lifetime. Verify the patch against your kernel version in the upstream Linux kernel repository or your distribution's security advisories. As an interim mitigation, disable NFQUEUE-based packet filtering if not operationally required, or restrict bridge creation and destruction to trusted administrators only. Systems without bridge forwarding enabled are not affected.

Patch guidance

Coordinate with your Linux distribution's security team to obtain the patched kernel version for your release. Canonical (Ubuntu), Red Hat, Debian, and other distributors will provide updated kernel packages. Test the patched kernel in a non-production environment first, particularly if you rely on bridge forwarding and NFQUEUE rules. Kernel reboots are typically required; schedule maintenance windows accordingly. Verify the patch is applied by checking kernel source or using distribution-provided security advisories with specific version numbers.

Detection guidance

Monitor for kernel panic logs mentioning use-after-free or address sanitizer warnings in br_netif_receive_skb() or nfqueue code paths. Enable audit logging for network namespace and bridge interface changes in privileged contexts. Network behavior detection is limited; focus on system-level telemetry. If NFQUEUE rules are in use, log packet queue depths and reinject operations to detect unusual patterns. Container escape or privilege escalation attempts may precede this exploit; correlate with process execution monitoring.

Why prioritize this

HIGH severity (CVSS 7.8) due to confidentiality, integrity, and availability impact combined with low attack complexity and local-only requirement. While not currently in active KEV exploitation (KEV: false), the reliability of the exploit and presence in kernel-intensive infrastructure (containers, NFV) makes this a significant internal risk. Organizations running bridged Kubernetes clusters or OpenStack should prioritize this as a critical stability and security issue.

Risk score, explained

CVSS 3.1 score of 7.8 reflects high impact (C:H/I:H/A:H) against local privilege boundary (S:U), low attack complexity (AC:L), and requirement for local user access (PR:L/AV:L). The use-after-free primitive permits both kernel crash and potential code execution. The score accurately reflects the severity for systems running the affected code path; systems without bridge forwarding or NFQUEUE are unaffected and should score lower contextually.

Frequently asked questions