CVE-2026-52912: Linux Kernel Use-After-Free Vulnerability

CVE-2026-52912 Overview

CVE-2026-52912 is a use-after-free vulnerability in the Linux kernel's netfilternf_queue subsystem when handling bridged packets. The flaw resides in how br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets through NFQUEUE. NFQUEUE only retains references on state.in, state.out, and bridge physdevs, leaving skb->dev pointing at a bridge master that may be freed before the userspace verdict returns. When the packet is reinjected, br_netif_receive_skb() dereferences the freed bridge master, producing a use-after-free condition in kernel memory.

Critical Impact
A freed bridge master device can be dereferenced during NFQUEUE packet reinjection, leading to kernel memory corruption and potential privilege escalation on systems using bridge netfilter with userspace queueing.

Affected Products

Linux Kernel (mainline) with bridge netfilter and nf_queue enabled
Stable kernel branches receiving backported fixes referenced in upstream commits
Systems leveraging NFQUEUE-based userspace packet inspection on bridged interfaces

Discovery Timeline

2026-06-24 - CVE-2026-52912 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-52912

Vulnerability Analysis

The Linux bridge stack invokes br_pass_frame_up() to deliver locally-destined frames to the bridge master device. Before queueing the packet via the netfilter LOCAL_IN hook, the function rewrites skb->dev from the ingress physical port to the bridge master interface. When an NFQUEUE rule is matched, the packet is suspended in the kernel and handed off to a userspace process for verdict.

While the packet sits in the queue, the kernel holds references on state.in, state.out, and the bridge physical input/output devices but does not hold a reference on the rewritten skb->dev. If the bridge master is torn down during this window, the underlying net_device structure is freed. On verdict reinjection, br_netif_receive_skb() reads skb->dev and operates on the freed memory, satisfying a classic use-after-free [CWE-416].

Root Cause

The root cause is asymmetric reference counting in the NFQUEUE entry. The queue entry tracks state.in/state.out and physdev pointers but treats skb->dev as transient. Because the bridge code rewrites skb->dev to the bridge master prior to queueing, this pointer is critical for correct reinjection and must outlive any administrative teardown of the bridge.

Attack Vector

A local attacker with capability to manage network namespaces or bridge interfaces can race the teardown of a bridge master against an in-flight NFQUEUE verdict. Triggering the path requires bridge LOCAL_IN traffic intercepted by an NFQUEUE rule and removal of the bridge while at least one packet awaits a verdict. Successful exploitation corrupts kernel memory and may lead to privilege escalation depending on heap layout and allocator behavior.

No public proof-of-concept code is available. The vulnerability mechanism is described in upstream commit messages referenced below.

Detection Methods for CVE-2026-52912

Indicators of Compromise

Kernel oops or panic messages referencing br_netif_receive_skb, nf_reinject, or nfqnl_reinject in dmesg or syslog
KASAN reports flagging use-after-free in net_device structures during bridge packet processing
Unexpected bridge interface teardown events correlated with NFQUEUE userspace handler activity

Detection Strategies

Enable CONFIG_KASAN on test or canary kernels to surface the use-after-free during fuzzing or stress testing
Audit running kernel versions against the patched commits listed in the Linux stable tree
Inventory hosts using nfnetlink_queue together with bridge netfilter (br_netfilter module loaded) to identify exposed systems

Monitoring Recommendations

Alert on kernel crash signatures involving br_netif_receive_skb or nfqnl_* symbols in production telemetry
Track creation and deletion of bridge interfaces alongside NFQUEUE rule activity in audit logs
Monitor auditd for CAP_NET_ADMIN operations from unprivileged service accounts

How to Mitigate CVE-2026-52912

Immediate Actions Required

Apply the upstream kernel patches that store skb->dev in the queue entry and hold a reference for the queue lifetime
Restrict CAP_NET_ADMIN and user namespace creation for untrusted local accounts to limit bridge teardown capability
Unload br_netfilter on systems that do not require netfilter hooks on bridged traffic

Patch Information

The fix stores skb->dev in the NFQUEUE entry, takes a reference on it for the lifetime of the queue, and uses the saved device when dropping queued packets during NETDEV_DOWN handling. The patches are available in the following Linux kernel commits:

Workarounds

Remove NFQUEUE rules from the bridge LOCAL_IN hook until the patched kernel is deployed
Disable br_netfilter by setting net.bridge.bridge-nf-call-iptables=0 and unloading the module where feasible
Avoid dynamic bridge master teardown on hosts running long-lived userspace verdict handlers