CVE-2026-72255

This is a use-after-free in the Linux kernel's bridge netfilter subsystem that exploits a lifecycle mismatch between a memory optimization and an asynchronous packet handling API. The br_netfilter module uses a 'fake dst' optimization — embedding an rtable structure directly in struct net_bridge rather than allocating one per packet. This works for synchronous packet processing where the bridge device lifetime matches packet processing duration. NFQUEUE breaks this assumption by holding packets indefinitely in userspace while the bridge device may be torn down. The fix records the bridge device in nf_queue_entry and manages its reference count, adding lifecycle tracking to a structure that previously had none. This is the correct layer to address the issue, but it commits NFQUEUE to participating in bridge device teardown — an abstraction boundary that wasn't anticipated in the original design. What matters practically: this transforms exploitation from a nanosecond timing race into a schedule control problem. An attacker who can trigger NFQUEUE verdicts can extend the bridge device lifetime arbitrarily by simply delaying the verdict. In container and VM environments where orchestration tooling creates and destroys bridges frequently, this reachability concern is more realistic than the low EPSS (0.00164) suggests. Audit your packet processing paths: any skb_dst_set_noref() usage with an embedded structure that could be torn down while packets are in flight to NFQUEUE, XDP, or similar async consumers is a candidate for the same pattern. The historical record shows dst-based optimizations repeatedly colliding with async consumers — IPVS, tunnel endpoints, and traffic shaping have all seen similar issues. This is not an isolated bug but a recurring class driven by the kernel's network stack being retrofitted with asynchronous extensions faster than lifecycle audits catch up.

Reviewed through automated stages and approved by a human before publication.