CVE-2026-72255

A flaw was found in the Linux kernel's netfilter component, specifically within the nf_queue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination ('dst') even after the bridge teardown has begun. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated, potentially causing system instability or a denial of service.

An IMPORTANT-severity use-after-free flaw was found in the Linux kernel's netfilter nf_queue subsystem. When a bridged packet carrying the br_netfilter fake destination (dst) is queued to NFQUEUE, __nf_queue() upgrades that fake dst into a real dst reference. If the bridge device begins teardown while the packet is still queued, the fake rtable embedded in struct net_bridge and its metrics backing storage can be freed while still referenced, resulting in a use-after-free that can crash the kernel and cause a denial of service. Red Hat rates this flaw IMPORTANT with CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), matching the CVE.org score, which reflects a local attack vector requiring privileges on the affected host rather than remote exploitability. The Red Hat Enterprise Linux kernel and kernel-rt components are affected, and a fix is being pursued by the Red Hat kernel team; Red Hat In-Vehicle OS kernels are not affected because the vulnerable code is not present in those products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.