---
cve: "CVE-2026-52912"
severity: "HIGH"
cvss: 7.8
epss: "14%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-06-24 08:16:20"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-18T21:58:25+02:00"
---

# CVE-2026-52912

> 7.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_queue: hold bridge skb->dev while queued

br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge
master before queueing bridge LOCAL_IN packets. NFQUEUE only holds
references on state.in/out and bridge physdevs, so a queued bridge
packet can retain a freed bridge master in skb->dev until reinjection.

When the verdict is reinjected later, br_netif_receive_skb() re-enters
the receive path with skb->dev still pointing at the freed bridge master,
triggering a use-after-free.

Store skb->dev in the queue entry, hold a reference on it for the queue
lifetime, and use the saved device when dropping queued packets during
NETDEV_DOWN handling.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.259
- Kernel ≥ 5.15.209
- Kernel ≥ 6.1.175
- Kernel ≥ 6.6.142
- Kernel ≥ 6.12.92
- Kernel ≥ 6.18.34
- Kernel ≥ 7.0.11

## Referenzen

- <https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57>
- <https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e>
- <https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac>
- <https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be>
- <https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644>
- <https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2>
- <https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f>
- <https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce>
- <https://cert-portal.siemens.com/productcert/html/ssa-019113.html>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-52912) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_