Linux Kernel up to 7.1.4 nf_queue __nf_queue reference count

CVSS Meta Temp Score CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.	Current Exploit Price (≈) Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.	CTI Interest Score Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
9.5	$0-$5k	0.00

Summaryinfo

A vulnerability was found in Linux Kernel up to 6.1.177/6.6.144/6.12.96/6.18.39/7.1.4. It has been declared as very critical. Affected by this issue is the function __nf_queue of the component nf_queue. Such manipulation leads to reference count. This vulnerability is listed as CVE-2026-72255. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Linux Kernel up to 6.1.177/6.6.144/6.12.96/6.18.39/7.1.4 and classified as very critical. Affected by this issue is the function __nf_queue of the component nf_queue. The manipulation with an unknown input leads to a reference count vulnerability. Using CWE to declare the problem leads to CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. Impacted is confidentiality, integrity, and availability. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst The br_netfilter fake rtable is embedded in struct net_bridge and is attached to bridged packets with skb_dst_set_noref(). If such a packet is queued to NFQUEUE, __nf_queue() upgrades that fake dst with skb_dst_force(). At that point the queued skb can hold a real dst reference after bridge teardown has started. The problem is not that every bridged packet needs its own dst reference. The problem is that NFQUEUE can keep the bridge private fake dst alive after unregister begins. Fix this by keeping the bridge fake dst model unchanged and pinning the bridge master device only while the packet sits in NFQUEUE. Record the bridge device in nf_queue_entry when the queued skb carries a bridge fake dst, take a device reference for the queue lifetime, and drop it when the queue entry is freed. Also make sure queued entries are reaped when that bridge device goes down, and drop the redundant nf_bridge_info_exists() test from the fake dst detection. This keeps netdev_priv(br->dev) alive until verdict completion, so the embedded fake rtable and its metrics backing storage cannot be freed out from under dst_release(). It also avoids the constant refcount bump and avoids using ipv4-specific dst helpers for IPv6 bridge traffic.

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2026-72255 since 08/09/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 08/15/2026).

Upgrading to version 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 or 7.2-rc1 eliminates this vulnerability. Applying the patch 430521af7fe8a9c08f5a2554224a35f11f51d99e/3f03a2d225c668283110ad5f9ff159ba4591e2c7/01ace27af47801dd7f6b839e782b62863af979cc/0ca505346c5e2905ab7b5313af801fcf38f594a8/47b3af24de5fbed4bf2952de0f5294ef1a338a26/c9c9b37f8c5505224e8d206184df3bb668ee00cf is able to eliminate this problem.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.1.177
• 6.6.144
• 6.12.0
• 6.12.1
• 6.12.2
• 6.12.3
• 6.12.4
• 6.12.5
• 6.12.6
• 6.12.7
• 6.12.8
• 6.12.9
• 6.12.10
• 6.12.11
• 6.12.12
• 6.12.13
• 6.12.14
• 6.12.15
• 6.12.16
• 6.12.17
• 6.12.18
• 6.12.19
• 6.12.20
• 6.12.21
• 6.12.22
• 6.12.23
• 6.12.24
• 6.12.25
• 6.12.26
• 6.12.27
• 6.12.28
• 6.12.29
• 6.12.30
• 6.12.31
• 6.12.32
• 6.12.33
• 6.12.34
• 6.12.35
• 6.12.36
• 6.12.37
• 6.12.38
• 6.12.39
• 6.12.40
• 6.12.41
• 6.12.42
• 6.12.43
• 6.12.44
• 6.12.45
• 6.12.46
• 6.12.47
• 6.12.48
• 6.12.49
• 6.12.50
• 6.12.51
• 6.12.52
• 6.12.53
• 6.12.54
• 6.12.55
• 6.12.56
• 6.12.57
• 6.12.58
• 6.12.59
• 6.12.60
• 6.12.61
• 6.12.62
• 6.12.63
• 6.12.64
• 6.12.65
• 6.12.66
• 6.12.67
• 6.12.68
• 6.12.69
• 6.12.70
• 6.12.71
• 6.12.72
• 6.12.73
• 6.12.74
• 6.12.75
• 6.12.76
• 6.12.77
• 6.12.78
• 6.12.79
• 6.12.80
• 6.12.81
• 6.12.82
• 6.12.83
• 6.12.84
• 6.12.85
• 6.12.86
• 6.12.87
• 6.12.88
• 6.12.89
• 6.12.90
• 6.12.91
• 6.12.92
• 6.12.93
• 6.12.94
• 6.12.95
• 6.12.96
• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.18.17
• 6.18.18
• 6.18.19
• 6.18.20
• 6.18.21
• 6.18.22
• 6.18.23
• 6.18.24
• 6.18.25
• 6.18.26
• 6.18.27
• 6.18.28
• 6.18.29
• 6.18.30
• 6.18.31
• 6.18.32
• 6.18.33
• 6.18.34
• 6.18.35
• 6.18.36
• 6.18.37
• 6.18.38
• 6.18.39
• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

VulDB Vector: 🔒
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 10.0
VulDB Meta Temp Score: 9.5

VulDB Base Score: 10.0
VulDB Temp Score: 9.5
VulDB Vector: 🔒
VulDB Reliability: 🔍

CVSSv2info

AV	AC	Au	C	I	A
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳

Vector	Complexity	Authentication	Confidentiality	Integrity	Availability
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍

Exploitinginfo

Class: Reference count
CWE: CWE-911 / CWE-664
CAPEC: 🔒
ATT&CK: 🔒

Physical: No
Local: No
Remote: Yes

Availability: 🔒
Status: Not defined
Price Prediction: 🔍
Current Price Estimation: 🔒

0-Day	Unlock	Unlock	Unlock	Unlock
Today	Unlock	Unlock	Unlock	Unlock

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Upgrade
Status: 🔍

0-Day Time: 🔒

Upgrade: Kernel 6.1.178/6.6.145/6.12.97/6.18.40/7.1.5/7.2-rc1
Patch: 430521af7fe8a9c08f5a2554224a35f11f51d99e/3f03a2d225c668283110ad5f9ff159ba4591e2c7/01ace27af47801dd7f6b839e782b62863af979cc/0ca505346c5e2905ab7b5313af801fcf38f594a8/47b3af24de5fbed4bf2952de0f5294ef1a338a26/c9c9b37f8c5505224e8d206184df3bb668ee00cf

Timelineinfo

08/09/2026 CVE reserved
08/15/2026 +6 days Advisory disclosed
08/15/2026 +0 days VulDB entry created
08/15/2026 +0 days VulDB entry last update

Sourcesinfo

Vendor: kernel.org

Advisory: git.kernel.org
Status: Confirmed

CVE: CVE-2026-72255 (🔒)
GCVE (CVE): GCVE-0-2026-72255
GCVE (VulDB): GCVE-100-390578

Entryinfo

Created: 08/15/2026 13:00
Changes: 08/15/2026 13:00 (59)
Complete: 🔍
Cache ID: 216::103

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion

Do you want to use VulDB in your project?

Use the official API to access entries easily!