What is CVE-2026-52912?

CVE-2026-52912 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10, classified as a Use After Free flaw (CWE-416), affecting Linux kernel versions from 4.7 onward and patched in 5.10.259, 5.15.209, 6.1.175 and others. CVE-2026-52912 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is the CVSS score for CVE-2026-52912?

CVE-2026-52912 has a CVSS score of 7.8 out of 10, rated High severity. The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Is there a patch available for CVE-2026-52912?

Yes, CVE-2026-52912 has been patched. Fixed versions include 5.10.259, 5.15.209, 6.1.175 and others. If you are running Linux kernel 4.7 or later up to the fix versions, apply the relevant patch for your kernel branch.

Is CVE-2026-52912 actively exploited?

CVE-2026-52912 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

What is Use After Free (CWE-416)?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. See MITRE CWE for full details: https://cwe.mitre.org/data/definitions/416.html

CVE-2026-52912

High

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: hold bridge skb->dev while queued br_pass_frame_up() rewrites skb->dev from the ingress port to the bridge master before queueing bridge LOCAL_IN packets. NFQUEUE only holds references on state.in/out and bridge physdevs, so a queued bridge packet can retain a freed bridge master in skb->dev until reinjection. When the verdict is reinjected later, br_netif_receive_skb() re-enters the receive path with skb->dev still pointing at the freed bridge master, triggering a use-after-free. Store skb->dev in the queue entry, hold a reference on it for the queue lifetime, and use the saved device when dropping queued packets during NETDEV_DOWN handling.

Package Linux Kernel

Published 2026-06-24

Last modified 2026-07-08

CVSS version 3.1

Patch available

Yes

CVSS 3.1 score

7.8

out of 10

High

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness type

CWE-416

CVE-2026-52912 is a Use After Free vulnerability

What is Use After Free?

The product references memory after it has been freed, which may cause it to crash, use unexpected values, or execute code. Learn more on MITRE CWE

Affected versions

Linux kernel versions 4.7 and later are affected. Fixed in 5.10.259, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, 7.1 and their respective stable series.

Affected from

≥ 4.7

Fixed in

✓ 5.10.259 5.10.x ✓ 5.15.209 5.15.x ✓ 6.1.175 6.1.x ✓ 6.6.142 6.6.x ✓ 6.12.92 6.12.x ✓ 6.18.34 6.18.x ✓ 7.0.11 7.0.x ✓ 7.1

References

8 total

Kernel Git
https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2

Patch
Kernel Git
https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac

Patch
Kernel Git
https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be

Patch
Kernel Git
https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644

Patch
Kernel Git
https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f

Patch

Showing 5 of 8 references View all on NVD

Details

CVE ID CVE-2026-52912

Severity High

CVSS score 7.8 / 10

CVSS version 3.1

Published 2026-06-24

Modified 2026-07-08

KEV No

Patch

Yes

Package linux

Frequently asked questions

What is CVE-2026-52912?

CVE-2026-52912 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 , classified as an Use After Free flaw (CWE-416) . It affects Linux kernel versions from 4.7 onward and has been patched in 5.10.259, 5.15.209, 6.1.175 and others. CVE-2026-52912 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
What is the CVSS score for CVE-2026-52912?

CVE-2026-52912 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Is there a patch available for CVE-2026-52912?

Yes. CVE-2026-52912 has been patched. Fixed versions include 5.10.259, 5.15.209, 6.1.175 and others. If you are running Linux kernel 4.7 or later up to the fix versions, apply the relevant patch for your kernel branch.
Is CVE-2026-52912 actively exploited?

No. CVE-2026-52912 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.