Look up another CVE · open CVE-2026-72255 in the interactive tracker
CVE-2026-72255
netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem include/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72255 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). If such a packet is queued to NFQUEUE, __nf_queue() upgrades that fake dst with skb_dst_force(). At that point the queued skb can hold a real dst reference after bridge teardown has started. The problem is not that every bridged packet needs its own dst reference. The problem is that NFQUEUE can keep the bridge private fake dst alive after unregister begins. Fix this by keeping the bridge fake dst model unchanged and pinning the bridge master device only while the packet sits in NFQUEUE. Record the bridge device in nf_queue_entry when the queued skb carries a bridge fake dst, take a device reference for the queue lifetime, and drop it when the queue entry is freed. Also make sure queued entries are reaped when that bridge device goes down, and drop the redundant nf_bridge_info_exists() test from the fake dst detection. This keeps netdev_priv(br->dev) alive until verdict completion, so the embedded fake rtable and its metrics backing storage cannot be freed out from under dst_release(). It also avoids the constant refcount bump and avoids using ipv4-specific dst helpers for IPv6 bridge traffic.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/net/netfilter/nf_queue.h
net/netfilter/nf_queue.c
net/netfilter/nfnetlink_queue.c
- What this is
- NETFILTERMAINTAINERS section matched on include/net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_NETFILTER /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
- Build switch
- CONFIG_NETFILTER
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 6.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.18 | 5.10.270 | 4e56d3d60d31 |
| 3.18 | 5.15.217 | 8dc513514728 |
| 3.18 | 6.1.178 | 430521af7fe8 |
| 3.18 | 6.6.145 | 3f03a2d225c6 |
| 3.18 | 6.12.97 | 01ace27af478 |
| 3.18 | 6.18.40 | 0ca505346c5e |
| 3.18 | 7.1.5 | 47b3af24de5f |
| 3.18 | 7.2 | c9c9b37f8c55 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached via netfilter NFQUEUE and local bridge/rtnetlink setup (__nf_queue skb_dst_force on br_netfilter's embedded fake rtable, then bridge teardown while packets remain queued), not from unauthenticated remote input alone; kernel guidance classifies netfilter/nftables paths as Local.
- AC:LAttack complexity, low
- With CAP_NET_ADMIN in a user namespace, an attacker can bind NFQUEUE, queue br_netfilter bridged packets, and delete the bridge while packets sit in the queue, deterministically hitting nfqnl_dev_drop/dst_release after struct net_bridge is freed.
- PR:LPrivileges required, low
- Configuring NFQUEUE/nftables rules, loading br_netfilter, creating/deleting bridges, and binding nfnetlink queues require CAP_NET_ADMIN, obtainable by unprivileged users via user/network namespaces (unshare -Urn), not init-namespace root.
- UI:NUser interaction, none
- Exploitation requires only the attacker's own netlink, nftables, and traffic generation; no victim must mount filesystems, open files, or perform other interactive actions beyond the attacker's programmatic setup.
- S:UScope, unchanged
- Impact is kernel heap corruption in the same host security domain via freed embedded fake_rtable/metrics inside struct net_bridge; this is standard kernel UAF/privilege-escalation territory, not a VM, IOMMU, or sandbox boundary escape.
- C:HConfidentiality impact, high
- skb_dst_force in __nf_queue holds a dst reference to fake_rtable storage embedded in struct net_bridge; after bridge unregister frees that object, dst_release operates on freed kmalloc memory—a UAF that can disclose kernel memory via slab reuse.
- I:HIntegrity impact, high
- The dangling fake rtable/metrics pointer in queued skbs can be combined with heap grooming to obtain arbitrary kernel writes or control-flow hijack during dst_destroy/netdev_put, consistent with kernel UAF integrity guidance.
- A:HAvailability impact, high
- Freeing queued NFQUEUE entries after bridge teardown dereferences freed net_bridge/fake_rtable in dst_release, causing kernel oops/panic-class faults; repeated triggering yields reliable denial of service on bridge/NFQUEUE deployments.