CVE-2026-72255
Description
A flaw was found in the Linux kernel's netfilter component, specifically within the nf_queue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination ('dst') even after the bridge teardown has begun. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated, potentially causing system instability or a denial of service.
Statement
An IMPORTANT-severity use-after-free flaw was found in the Linux kernel's netfilter nf_queue subsystem. When a bridged packet carrying the br_netfilter fake destination (dst) is queued to NFQUEUE, __nf_queue() upgrades that fake dst into a real dst reference. If the bridge device begins teardown while the packet is still queued, the fake rtable embedded in struct net_bridge and its metrics backing storage can be freed while still referenced, resulting in a use-after-free that can crash the kernel and cause a denial of service. Red Hat rates this flaw IMPORTANT with CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), matching the CVE.org score, which reflects a local attack vector requiring privileges on the affected host rather than remote exploitability. The Red Hat Enterprise Linux kernel and kernel-rt components are affected, and a fix is being pursued by the Red Hat kernel team; Red Hat In-Vehicle OS kernels are not affected because the vulnerable code is not present in those products.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
