Executive brief
A vulnerability in the Linux kernel's networking component could allow a system crash or unpredictable behavior. The issue occurs when network bridge traffic is processed by the firewall's queuing system, potentially leading to the use of memory that has already been freed. This typically happens during specific network configuration changes or high-traffic scenarios involving bridged interfaces.
Technical details
A use-after-free vulnerability exists in the Linux kernel netfilter subsystem (nf_queue). The function br_pass_frame_up() rewrites the skb->dev pointer from the ingress port to the bridge master before queueing LOCAL_IN packets. Because NFQUEUE does not maintain a reference count on the bridge master device, the device can be freed while the packet is still in the queue. Upon reinjection via br_netif_receive_skb(), the kernel attempts to access the now-freed bridge master device. The fix involves storing a reference to skb->dev in the queue entry to ensure the device remains valid until the packet is processed or dropped.
Affected products
- Linux Linux Kernel 4.7 to 6.13
Timeline
- 2026-06-24: advisory: CVE published by NVD
- 2026-06-01: patched: Fix committed to stable kernel trees by Greg Kroah-Hartman
References
- https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2
- https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac
- https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be
- https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644
- https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f
- https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57
- https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e