In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences… (CVE-2026-53220)
In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a common ancestor, this was always broken.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-53220 involves the netfilter bridge code where ebt_redirect_tg() dereferences the result of br_port_get_rcu() without a NULL check. If the bridge port is removed between the original hook invocation and an NFQUEUE reinject, this causes a kernel panic. The issue is compounded by the fact that userspace can remove the port or move the device to a different virtual device such as macvlan, making reinjection impossible. The fix replaces the use of the bridge port structure with the _upper API and drops packets when reinjection is not feasible. The vulnerability leads to a denial of service condition but does not affect confidentiality or integrity.
Potential Impact
Successful exploitation causes a kernel panic resulting in a denial of service (system crash). There is no impact on confidentiality or integrity. The vulnerability requires local privileges with low complexity and no user interaction. The attack vector is local (AV:L).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by switching to the _upper API and adding appropriate checks to prevent kernel panic. Until a patch is applied, avoid scenarios where bridge ports may be removed or moved during packet reinjection. Monitor vendor advisories for official fixes.
In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences… (CVE-2026-53220)
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a common ancestor, this was always broken.
CVSS v3.1
Score 5.5medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-53220 involves the netfilter bridge code where ebt_redirect_tg() dereferences the result of br_port_get_rcu() without a NULL check. If the bridge port is removed between the original hook invocation and an NFQUEUE reinject, this causes a kernel panic. The issue is compounded by the fact that userspace can remove the port or move the device to a different virtual device such as macvlan, making reinjection impossible. The fix replaces the use of the bridge port structure with the _upper API and drops packets when reinjection is not feasible. The vulnerability leads to a denial of service condition but does not affect confidentiality or integrity.
Potential Impact
Successful exploitation causes a kernel panic resulting in a denial of service (system crash). There is no impact on confidentiality or integrity. The vulnerability requires local privileges with low complexity and no user interaction. The attack vector is local (AV:L).
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by switching to the _upper API and adding appropriate checks to prevent kernel panic. Until a patch is applied, avoid scenarios where bridge ports may be removed or moved during packet reinjection. Monitor vendor advisories for official fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-7q5m-qv9w-c8xx
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53220"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a46eca927e9c7971943a69a
Added to database: 07/02/2026, 22:56:41 UTC
Last enriched: 07/02/2026, 23:01:49 UTC
Last updated: 07/31/2026, 19:24:49 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.