Linux Kernel EUVD-2026-39311

Exploitation requires all of the following: the Linux kernel must have bridge netfilter support compiled in (CONFIG_BRIDGE_NETFILTER or NETFILTER_FAMILY_BRIDGE enabled) and NFQUEUE support active (CONFIG_NETFILTER_NETLINK_QUEUE); an ebtables rule with the redirect target must be configured to queue packets via NFQUEUE in the bridge family; and the attacker must be able to both control a userspace NFQUEUE handler and remove or reassign bridge port membership - operations that typically require CAP_NET_ADMIN. Systems that do not use ebtables bridge filtering with NFQUEUE are entirely unaffected regardless of kernel version. The CVSS assignment of PR:L is noted, but meaningful exploitation in practice likely requires CAP_NET_ADMIN, which is above standard unprivileged user access; in containerized environments with user namespace bridge capabilities enabled, the effective privilege bar may be lower.

The NVD CVSS 3.1 score of 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a local, low-complexity denial-of-service with no confidentiality or integrity impact. The impact of a successful exploit is a kernel panic, which is severe but contained to the affected host. EPSS at 0.18% in the 7th percentile is consistent with the narrow exploitation prerequisites: the attacker must have local access, control over bridge port membership (typically requiring CAP_NET_ADMIN), an active NFQUEUE handler, and the ability to orchestrate the race between bridge port removal and packet reinject. There is no CISA KEV listing, no known public exploit code, and no indication of targeted or opportunistic exploitation. The low EPSS and medium CVSS together indicate this is a real but low-urgency patch-cycle item for most organizations. The primary risk population is containerized or multi-tenant Linux environments where unprivileged users may obtain CAP_NET_ADMIN via user namespaces, which could lower the practical privilege bar below the PR:L CVSS assignment. The CVSS AC:L assignment is defensible because the attacker controls both the NFQUEUE handler and the bridge port removal, making the race deliberate rather than probabilistic.

A local attacker with CAP_NET_ADMIN on a host using ebtables bridge filtering establishes an NFQUEUE handler and crafts an ebtables redirect rule that queues bridge traffic. The attacker sends a packet through the bridge to get it queued in NFQUEUE, then immediately removes the bridge port from the bridge while the packet is pending. When the attacker's NFQUEUE handler issues a reinject verdict, ebt_redirect_tg() calls br_port_get_rcu() which now returns NULL, and the unconditional dereference causes a kernel panic, crashing the host. No public exploit code has been identified at time of analysis.