CVE-2022-36946

CVE-2022-36946 Reported-by: Domingo Dirutigliano and Nicola Guerrera While we were working on firegex, our application firewall for CTF Attack-Defence competitions, we stumbled upon a few kernel panics. This strange behavour was than isolated and anlayzed, leading to the discovery of this potenti...

kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Rejects the immediate NFQUEUE verdict. The nftqueue is always used by the user-space nftables to deliver the NFQUEUE verdict. Immediate emission of the NFQUEUE verdict is never used by the user-space nft tool...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: It was discovered that nfqueue holds the bridgeskb-dev variable while the packet is being queued. The function brpassFrameup reassigns skb-dev from the ingress port to the bridge master before queuing bridge...

kernel: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: The pin bridge device is used while NFQUEUE holds a fake dst. The brnetfilter fake rtable is embedded in the struct netbridge and is attached to bridged packets using skbdstsetnoref. If such a packet is queued...

kernel: netfilter: nf_queue: hold bridge skb->dev while queued

A flaw was found in the Linux kernel's netfilter component. This vulnerability occurs because a queued bridge packet can retain a freed bridge master in its skb-dev field until it is reinjected. When the packet is later reinjected, the system attempts to use the freed bridge master, leading to a...

ROS-20260925-73-0132

The vulnerability of the nfqueue module in the Linux operating system’s kernel is related to out-of-buffer writing. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

kernel: netfilter: nf_queue: hold bridge skb->dev while queued

A flaw was found in the Linux kernel's netfilter component. This vulnerability occurs because a queued bridge packet can retain a freed bridge master in its skb-dev field until it is reinjected. When the packet is later reinjected, the system attempts to use the freed bridge master, leading to a...

kernel: netfilter: nf_queue: hold bridge skb->dev while queued

A flaw was found in the Linux kernel's netfilter component. This vulnerability occurs because a queued bridge packet can retain a freed bridge master in its skb-dev field until it is reinjected. When the packet is later reinjected, the system attempts to use the freed bridge master, leading to a...

AlmaLinux 8 : kernel-rt (ALSA-2026:71330)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:71330 advisory. kernel: drm/amdgpu: Fix fence put before wait in amdgpuamdkfdsubmitib CVE-2026-31566 kernel: netfilter: nfqueue: hold bridge skb-dev while queued...

The vulnerability of the nf_queue module in the Linux operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the nfqueue module in the Linux operating system’s kernel is related to out-of-buffer writing. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

SUSE CVE-2026-72255

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72255

A flaw was found in the Linux kernel's netfilter component, specifically within the nfqueue functionality. When a bridged packet is queued to NFQUEUE, it can retain a reference to a bridge's private fake destination 'dst' even after the bridge teardown has begun. This can lead to a use-after-free...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099750)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099750 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: hold bridge skb-dev while queued brpassframeup rewrites skb-dev from the...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100103)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100103 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: reject immediate NFQUEUE verdict nftqueue is always used from userspace...

CVE-2026-72255

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72255

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: pin bridge device while NFQUEUE holds fake dst The brnetfilter fake rtable is embedded in struct netbridge and is attached to bridged packets with skbdstsetnoref. If such a packet is queued to NFQUEUE, nfqueue...

CVE-2026-72255

The CVE affects the Linux kernel, specifically netfilter nf_queue interactions with bridged traffic. A br_netfilter fake rtable is embedded in struct net_bridge and attached to bridged packets via skb_dst_set_noref. When such a packet is queued to NFQUEUE, __nf_queue() upgrades the fake dst with ...