Linux Kernel CVE-2026-52912

Apply your distribution's kernel update to a fixed stable release: Vendor-released patch versions include 5.10.259, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 (and later), which add reference counting on the stored bridge device. Track the upstream stable commits at https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57 and the related kernel.org links, and consult the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-52912. Where immediate patching is not possible, the practical compensating control is to avoid the vulnerable code path: do not apply NFQUEUE/nfnetlink_queue verdict rules to bridge LOCAL_IN traffic (remove or scope nft/iptables rules that queue bridged packets), which eliminates the trigger but disables any userspace inspection those rules provided; alternatively, where bridging is not required, avoid placing local-host services behind a Linux bridge. Restrict local account access and the ability to create/destroy bridge interfaces (CAP_NET_ADMIN), since the bug requires low-privileged local interaction with the queuing path; note this limits legitimate network administration. There is no remote mitigation because the attack vector is local.