EUVD-2026-64562
GHSA-vjwv-39q4-jxgj
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Bridge operates at L2 requiring network adjacency (AV:A); non-default nftables ct zone set rule must be configured (AC:H); no privileges or user interaction needed to send non-IP frames.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: release template ct on non-IP path
A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.
Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
AnalysisAI
Memory exhaustion in the Linux kernel's netfilter bridge subsystem allows network-adjacent unauthenticated attackers to cause denial of service by sending non-IP Ethernet frames through a bridge host configured with nftables conntrack zone set rules. The root cause is that nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED for non-IPv4/non-IPv6 EtherTypes without releasing the existing conntrack template reference, leaking slab memory indefinitely until the host exhausts kernel memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two specific conditions must both be present for exploitation: (1) a bridge nftables rule using ct zone set must be explicitly configured by a system administrator - this is a non-default deployment decision used to assign conntrack zones to bridged traffic, and (2) non-IPv4/non-IPv6 Ethernet frames (EtherTypes such as ARP 0x0806, MPLS 0x8847, or other L2 protocols) must traverse the bridge interface. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) overstates real-world exploitability on two metrics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with Layer 2 adjacency to a network segment bridged by a vulnerable Linux host continuously floods the bridge with non-IP Ethernet frames such as ARP requests or MPLS packets. Because the host has a bridge nftables ct zone set rule configured, each frame causes nf_ct_bridge_pre() to attach and then abandon a conntrack template reference, incrementally leaking slab memory. … |
| Remediation | Update to the appropriate patched stable kernel: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2+, depending on the branch in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux hosts running nftables with conntrack zone rules using nft list tables | grep 'ct zone' to scope affected systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today