---
title: "CVE-2026-52912 — A queued bridge packet could outlive the bridge that owned it"
description: "CVE-2026-52912: A bridge packet sent to an NFQUEUE could keep a pointer to the bridge device without keeping that device alive. Deleting the bridge while the packet waited in userspace left the queued packet pointing at freed kernel memory. Fixed upstream in May 2026."
url: https://nebusec.ai/buglist/CVE-2026-52912/
published: 2026-08-22T00:00:00.000Z
---

CVE-2026-52912 · High

# A queued bridge packet could outlive the bridge that owned it

Linux kernel · bridge netfilter · Published Aug 22, 2026

br_pass_frame_up

* [CVSS 7.8 · CNA ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-52912)
* Fixed
* Use-after-free
* Namespace required

Affects · Fedora 44 · Linux 6.19.10-300 demo target · Bridge netfilter with NFQUEUE

[View exploit→](#exploit)

Artifacts · [exploit.md](#exploit) · [patch.diff](#patch)

## Summary

A bridge packet sent to an NFQUEUE could keep a pointer to the bridge device without keeping that device alive. Deleting the bridge while the packet waited in userspace left the queued packet pointing at freed kernel memory.

The public exploit was validated on Fedora 44 with Linux 6.19.10-300, including SELinux and randomized kernel allocation caches. The issue was fixed upstream in May 2026.

## Why it mattered

A local attacker with access to a network namespace could queue a bridge-local packet, remove the bridge, and then resume processing. That lifecycle gap could be turned from a crash into kernel memory reuse and local privilege escalation.

The affected code has been fixed. The risk described here applies to unpatched kernels in the affected line, not automatically to every system using the named distribution today.

## What went wrong

`br_pass_frame_up()` changed `skb->dev` to the bridge master before invoking netfilter. NFQUEUE retained references to the hook input device, but not to the different bridge device stored in the packet, so teardown was free to release it.

## Exploit

Because the issue and its fixes are public, NebuSec’s validation code is included here for reproducibility. The preview starts at the program entry point and shows exactly 15 lines. Expanding it reveals the complete selected C file embedded in this page; build files, headers, helpers, and any additional sources remain in the linked CyberMeowfia directory.

Public exploit · patched target

CyberMeowfia snapshot4c1f0aa

[Browse all files](https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-52912-Fedora-6.19.10-300)

Exploit entry point · 1042 lines · [Open at main() ↗](https://github.com/NebuSec/CyberMeowfia/blob/4c1f0aaaf1b981e74c47f24d88ebdf6ad51c9586/security-research/Linux-CVE-2026-52912-Fedora-6.19.10-300/exploit.c#L1017)

```c
int main(int argc, char **argv)
{
  if (argc == 2 && !strcmp(argv[1], "--worker"))
    return worker_main();
  setvbuf(stdout, NULL, _IONBF, 0);
  drop_to_nobody_if_root();
  for (int attempt = 1; attempt <= 3; attempt++) {
    pid_t child = fork();
    int status;
    if (child < 0)
      die("fork(worker)");
    if (!child) {
      execl("/proc/self/exe", "exploit", "--worker", NULL);
      _exit(127);
    }
```

The selected file is the execution entry point. Build files, headers, leak helpers, and supporting sources remain in the linked CyberMeowfia directory.

## Patch

**Fixed upstream in May 2026.** The fixed path preserves the device lifetime for queued packets. Distribution kernel updates are the primary remedy; where an update is delayed, avoiding bridge NFQUEUE rules in attacker-controlled namespaces removes the demonstrated path.

The safest check is the distribution’s own kernel changelog for `CVE-2026-52912`; version numbers alone can be misleading because vendors routinely backport security fixes without changing to the newest upstream kernel.

Find bugs in your code.

Before anyone else does.

[Book a demo](https://nebusec.ai/book-a-demo/)