Skip to main content

Linux Kernel CVE-2026-53220

| EUVDEUVD-2026-39311 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-7q5m-qv9w-c8xx
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack vector with no confidentiality or integrity impact; attacker controls both NFQUEUE timing and bridge port removal, making AC:L appropriate despite the race condition.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 02, 2026 - 23:01 vuln.today
CVSS changed
Jul 02, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: revalidate bridge ports

ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject.

A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan.

If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path.

Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact:

Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off.

Fixes tag is a common ancestor, this was always broken.

AnalysisAI

NULL pointer dereference in the Linux kernel netfilter bridge redirect target crashes the kernel when a bridge port is removed or reassigned between an initial NFQUEUE hook invocation and packet reinject. The affected function ebt_redirect_tg() in the ebtables bridge filtering subsystem calls br_port_get_rcu() without guarding against a NULL return, and the additional complexity noted in the fix is that a mere NULL check would still be insufficient - userspace can move the device into a macvlan while the packet is queued, requiring the packet to be dropped entirely. This flaw has existed since commit f350a0a87374418635689471606454abc7beaa3a (kernel 2.6.36), making it a long-standing latent bug. No public exploit identified at time of analysis; EPSS at 0.18% (7th percentile) signals negligible automated exploitation risk.

Technical ContextAI

The vulnerability lives in the Linux kernel's ebtables bridge netfilter subsystem, specifically the ebt_redirect target (net/bridge/netfilter/ebt_redirect.c). Netfilter NFQUEUE allows packets to be suspended in kernel space and forwarded to a userspace process for a verdict; when the verdict is to reinject the packet, the kernel re-enters the netfilter hook chain. In the bridge context, ebt_redirect_tg() uses br_port_get_rcu() to retrieve the bridge port structure associated with the incoming device. Because bridge port membership can be changed by userspace at any time - including during the window when a packet is queued in NFQUEUE - the pointer returned by br_port_get_rcu() may be NULL on reinject if the port was removed. The fix replaces the approach with the _upper API, which avoids the need for the bridge port structure entirely and instead drops the packet if it is no longer in a valid bridge context. The root cause is CWE-476 (NULL Pointer Dereference). Affected software is identified by CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, and the feature requires CONFIG_BRIDGE_NETFILTER (or NETFILTER_FAMILY_BRIDGE) and CONFIG_NETFILTER_NETLINK_QUEUE to be enabled.

RemediationAI

Upgrade the Linux kernel to a patched stable release: 6.12.94, 6.18.36, 7.0.13, or 7.1. The upstream fix commits can be found at https://git.kernel.org/stable/c/43330a1e8aace6b5a8de9aba127e9e394ab49b0f (6.12), https://git.kernel.org/stable/c/ccb9fd4b87538ccf19ccff78ee26700526d94867 (6.18), https://git.kernel.org/stable/c/d4b1301fd3c9e5e105fd3767c68bc4ba558bb228 (7.0), and https://git.kernel.org/stable/c/4beffcd726e2a731cea4dc18e1fbc55c8d76f1a0. Where immediate kernel upgrades are not feasible, the specific compensating control is to remove any ebtables rules that use NFQUEUE in the bridge netfilter family (NETFILTER_FAMILY_BRIDGE), since the race cannot trigger without an active NFQUEUE target in bridge context; this trade-off disables packet queuing for bridge-level inspection but eliminates the vulnerable code path. Additionally, restricting CAP_NET_ADMIN to trusted processes and avoiding user namespace configurations that grant unprivileged bridge management reduces the realistic attacker population. These workarounds affect bridge-level traffic inspection workflows and should be evaluated against operational requirements.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53220 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy