Answer in brief
CVE-2026-53220 records a Medium severity (CVSS 5.5) vulnerability in netfilter: revalidate bridge ports. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f350a0a87374418635689471606454abc7beaa3a <98cc0403f546c52104d654fa24d86e9bcac964d3 || >=f350a0a87374418635689471606454abc7beaa3a <43330a1e8aace6b5a8de9aba127e9e394ab49b0f || >=f350a0a87374418635689471606454abc7beaa3a <4beffcd726e2a731cea4dc18e1fbc55c8d76f1a0 || >=f350a0a87374418635689471606454abc7beaa3a <d4b1301fd3c9e5e105fd3767c68bc4ba558bb228 || >=f350a0a87374418635689471606454abc7beaa3a <ccb9fd4b87538ccf19ccff78ee26700526d94867 | 98cc0403f546c52104d654fa24d86e9bcac964d3, 43330a1e8aace6b5a8de9aba127e9e394ab49b0f, 4beffcd726e2a731cea4dc18e1fbc55c8d76f1a0, d4b1301fd3c9e5e105fd3767c68bc4ba558bb228, ccb9fd4b87538ccf19ccff78ee26700526d94867 |
| Linux/Linuxgeneric | 2.6.36 | Not reported |
Published upstream
Jun 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 25, 2026
In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a common ancestor, this was always broken.
Quoted source text, attributed separately from HOL analysis.