{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"950d809f154dca04e5fbe5d3c8b9c5e44769cd57","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"},{"lessThan":"a698ac8ab2561cf575d2d9f34095032651dd952e","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"},{"lessThan":"19924bdd8a45ebc72a7b84c57fd63057d1dc75ac","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"},{"lessThan":"1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"},{"lessThan":"3823c27099cfe2482299065814adbaa771be9644","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"},{"lessThan":"15d464265120ab9818bd673af301deee09bedab2","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"},{"lessThan":"3fb0f5c0f64162a8c3f25616a4f1e340b921737f","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"},{"lessThan":"e196115ec330a18de415bdb9f5071aa9f08e53ce","status":"affected","version":"ac28634456867b23b95faccba7997a62ec430603","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"4.7"},{"lessThan":"4.7","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.209","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.175","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.142","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","source":"ADP: siemens-SADP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.7","versionType":"custom"}]}],"cveId":"CVE-2026-52912","cwes":["CWE-416"],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_queue: hold bridge skb->dev while queued\n\nbr_pass_frame_up() rewrites skb->dev from the ingress port to the bridge\nmaster before queueing bridge LOCAL_IN packets. NFQUEUE only holds\nreferences on state.in/out and bridge physdevs, so a queued bridge\npacket can retain a freed bridge master in skb->dev until reinjection.\n\nWhen the verdict is reinjected later, br_netif_receive_skb() re-enters\nthe receive path with skb->dev still pointing at the freed bridge master,\ntriggering a use-after-free.\n\nStore skb->dev in the queue entry, hold a reference on it for the queue\nlifetime, and use the saved device when dropping queued packets during\nNETDEV_DOWN handling.","epss":{"date":"2026-11-09","percentile":0.04874,"score":0.00157},"exploits":[],"kev":null,"metrics":[{"score":7.8,"severity":"high","source":"CNA: Linux","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794314861976,"publishedAt":1782285250583,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/950d809f154dca04e5fbe5d3c8b9c5e44769cd57"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/a698ac8ab2561cf575d2d9f34095032651dd952e"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/19924bdd8a45ebc72a7b84c57fd63057d1dc75ac"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/1e5e20031c5eee8d2e490a90ff4d6a2feecfc3be"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3823c27099cfe2482299065814adbaa771be9644"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/15d464265120ab9818bd673af301deee09bedab2"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3fb0f5c0f64162a8c3f25616a4f1e340b921737f"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/e196115ec330a18de415bdb9f5071aa9f08e53ce"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"ADP: siemens-SADP","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"remediation":[],"revision":"8d4aea8d516b95314bda59b4c0face164da15b29659283e6d07f823517a974bd","sources":[{"modifiedAt":1794314861976,"name":"CNA: Linux","retrievedAt":1794316667913,"url":"https://www.cve.org/CVERecord?id=CVE-2026-52912"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794316684276,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-52912"}],"ssvc":{"assessedAt":1792164150377,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"netfilter: nf_queue: hold bridge skb->dev while queued","updatedAt":1794316684276}