CVE-2026-72255 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel-based systems, especially those using NFQUEUE and bridge devices, should assess their exposure and prioritize verification and patching. This includes operators managing Linux kernel deployments, platform administrators, vulnerability management teams, and security teams responsible for monitoring and incident response.

Why it matters

A vulnerability in the Linux kernel's netfilter component requires verification and potential patching to prevent use-after-free scenarios.

• Potential use-after-free scenario due to fake destination reference.
• Need to verify Linux kernel versions and configurations.
• Prioritize patching to prevent potential exploitation.
• Monitor system logs for exploitation attempts.

Technical summary

The Linux kernel's netfilter component has a vulnerability related to the handling of bridge devices in NFQUEUE. When a packet is queued to NFQUEUE, it can hold a reference to a fake destination after bridge teardown has started. This issue can lead to a use-after-free scenario. The fix involves pinning the bridge master device while the packet is in NFQUEUE and ensuring that queued entries are reaped when the bridge device goes down.

Defensive priority

Defenders should assess exposure and prioritize verification of Linux kernel versions, focusing on systems using NFQUEUE and bridge devices.

Recommended defensive actions

• Assess Linux kernel versions in use and verify if they are affected by this vulnerability.
• Prioritize patching or upgrading Linux kernel versions that are impacted.
• Review NFQUEUE and bridge device configurations to ensure they are properly secured.
• Monitor system logs for potential exploitation attempts.
• Perform a thorough inventory of assets using the Linux kernel to identify potential exposure.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. Multiple source references from the Linux kernel Git repository are provided, detailing the changes made to address the issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.