CVE-2026-53220
Linux kernel: null pointer dereference
- Risk score
- 48/100
- CVSS
- 5.5 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 25 Jun 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL che…
- Affected
- Linux kernel
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: restore network header before routing and forwarding ipv6_srh_rcv() runs with skb->data at the Segment Routing Header (SRH) while skb_network_header() points at the IPv6 header. When segments_left > 0, ipv6_srh_rcv() previously restored the …
The flaws
- CVE-2026-53220: Null pointer dereference (CVSS 5.5 · EPSS 0%)
- CVE-2026-98096: Out-of-bounds write (CVSS 7.4 · EPSS 1%)
- CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
- CVE-2026-98117: Use-after-free (CVSS 7.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Linux kernel
Where it stands
- No known exploitation
How it unfolded
- 6 Nov, Ubuntu security notices (official): USN-9002-1: Linux kernel (NVIDIA Tegra) vulnerabilities
Connects to
- Same weakness: Null pointer dereference (CWE-476). 151 other warnings in 30 days
- Same product: Earlier Linux kernel warnings. 176 in the last 90 days
Why it is Yellow
- CVSS 5.5 medium
- On your watchlist: linux kernel
- Named in a government or vendor bulletin
Government and vendor bulletins
References
- https://ubuntu.com/security/notices/USN-9002-1
- https://git.kernel.org/stable/c/43330a1e8aace6b5a8de9aba127e9e394ab49b0f
- https://git.kernel.org/stable/c/4beffcd726e2a731cea4dc18e1fbc55c8d76f1a0
- https://git.kernel.org/stable/c/98cc0403f546c52104d654fa24d86e9bcac964d3
- https://git.kernel.org/stable/c/a1c12915d2502aff00df82f4ccb8c214f956129d
- https://git.kernel.org/stable/c/ccb9fd4b87538ccf19ccff78ee26700526d94867
- https://git.kernel.org/stable/c/d4b1301fd3c9e5e105fd3767c68bc4ba558bb228
Original description
In the Linux kernel, the following vulnerability has been resolved: netfilter: revalidate bridge ports ebt_redirect_tg() dereferences br_port_get_rcu() return without a NULL check, causing a kernel panic when the bridge port has been removed between the original hook invocation and an NFQUEUE reinject. A mere NULL check isn't sufficient, however. As sashiko review points out userspace can not only remove the port from the bridge, it could also place the device in a different virtual device, e.g. macvlan. If this happens, we must drop the packet, there is no way for us to reinject it into the bridge path. Switch to _upper API, we don't need the bridge port structure. Also, this fix keeps another bug intact: Both nfnetlink_log and nfnetlink_queue use CONFIG_BRIDGE_NETFILTER too aggressive, which prevents certain logging features when queueing in bridge family: NETFILTER_FAMILY_BRIDGE can be enabled while the old CONFIG_BRIDGE_NETFILTER cruft is off. Fixes tag is a common ancestor, this was always broken.
Last activity 6 Nov 2026. Patch Forecast updates every hour.