CVE-2026-72255 Linux CVE debrief

Who should care

Linux kernel users and administrators, network security teams, and those responsible for maintaining systems that utilize netfilter and NFQUEUE should be aware of this vulnerability. They should verify their configurations and apply patches to mitigate potential risks associated with netfilter and NFQUEUE. The vulnerability has a significant impact on network security teams and those responsible for maintaining systems that utilize netfilter and NFQUEUE. Linux kernel users should review their configurations and apply patches to ensure the fix for pinning bridge devices is implemented. They should also monitor network traffic and system logs for suspicious activity related to NFQUEUE. Additionally, Linux kernel users should verify their configurations for netfilter and NFQUEUE usage and apply patches to ensure the fix for pinning bridge devices is implemented. Those responsible for maintaining systems that utilize netfilter and NFQUEUE should review compensating controls for exposed systems while remediation is scheduled and verified. They should also check relevant monitoring, detection, and logs for exposed assets that need extra review. Linux kernel users and administrators should track exceptions, retest remediated assets, and close the item only after evidence is documented. They should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. They should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. They should review compensating controls for exposed systems while remediation is scheduled and verified. They should check relevant monitoring, detection, and logs for exposed assets that need extra review. They should track exceptions, retest remediated assets, and close the item only after evidence is documented. Linux kernel users and administrators should be aware of the potential risks associated with this vulnerability and take necessary steps to mitigate them. They should be aware of the impact of this vulnerability on their

Technical summary

The Linux kernel vulnerability (CVE-2026-72255) involves a problem with netfilter's NFQUEUE holding fake dst, which can lead to issues after bridge teardown has started. The fix pins the bridge device while packets are queued. The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). If such a packet is queued to NFQUEUE, __nf_queue() upgrades that fake dst with skb_dst_force(). The queued skb can hold a real dst reference after bridge teardown has started. The problem is not that every bridged packet needs its own dst reference. The problem is that NFQUEUE can keep the bridge private fake dst alive after unregister begins. The fix involves pinning the bridge master device only while the packet sits in NFQUEUE. Record the bridge device in nf_queue_entry when the queued skb carries a bridge fake dst, take a device reference for the queue lifetime, and drop it when the queue entry is freed. Also, make sure queued entries are reaped when that bridge device goes down, and drop the redundant nf_bridge_info_exists() test from the fake dst detection.

Defensive priority

Linux kernel users should verify their configurations and apply patches to mitigate potential risks associated with netfilter and NFQUEUE.

Recommended defensive actions

• Verify Linux kernel configurations for netfilter and NFQUEUE usage.
• Apply patches to ensure the fix for pinning bridge devices is implemented.
• Monitor network traffic and system logs for suspicious activity related to NFQUEUE.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The CVE is related to a vulnerability in the Linux kernel's netfilter component, specifically with NFQUEUE holding fake dst. The fix involves pinning the bridge device while the packet sits in NFQUEUE.

Official resources