CVE-2026-52912: Linux Kernel Root Exploit PoC Disclosed

TL;DR

CVE-2026-52912 is a use-after-free flaw in the Linux kernel’s netfilter nf_queue code. It carries a CVSS score of 7.8. Researchers at Nebula Security have publicly disclosed the vulnerability details and released proof-of-concept exploit code that escalates to root.

Why It Matters

Local attackers care about one thing: getting root. This flaw gives them a path. A public exploit lowers the bar for real attacks. The bug also sat in the kernel for years. It was introduced back in March 2016 and fixed upstream only in May 2026.

How the Attack Works

The problem lives in bridge packet handling. When the bridge passes local packets up, it rewrites the skb->dev field to the bridge master. NFQUEUE then queues the packet for a userspace verdict. However, it does not hold a reference on that device.

So the bridge master can be freed while the packet waits. On reinjection, the kernel reuses the freed pointer. That triggers the use-after-free. The upstream fix stores the device in the queue entry and holds a reference for its lifetime. Beyond crashes, Nebula Security showed the bug enables Linux kernel privilege escalation to root.

Exploitation Status

A public proof-of-concept now exists for CVE-2026-52912. Nebula Security demonstrated a working root escalation in a video shared on the Nebula Security post on X. The team also published the exploit code in a GitHub research repository. No exploitation in the wild has been confirmed yet.

Today's exploit is for the latest Fedora 44, a UAF in netfilter, CVE-2026-52912.

It was introduced in Mar 2016 and fixed upstream in May 2026.

Discovered and exploited by the NebuSec security pipeline. (RANDOM_KMALLOC_CACHES + SELinux)

Exp source code: https://t.co/jlanCsTkft pic.twitter.com/WZO8z1uPBU

— Nebula Security (@nebusecurity) August 22, 2026

Affected Versions

The flaw affects Linux kernels carrying the vulnerable nf_queue code from 2016 onward. The public PoC targets Fedora on kernel 6.19.10-300. Other distributions on unpatched kernels remain at risk. Systems using bridge networking with NFQUEUE rules face the highest exposure.

Patch and Mitigation

Update the kernel first. Apply the upstream fix or your distribution’s patched build. Reboot to load the new kernel. Where patching must wait, limit local access to trusted users. Also review whether bridge and NFQUEUE rules are truly needed. Given the public exploit for CVE-2026-52912, treat patching as urgent.

Support Our Threat Intelligence

If you find our CVE report and cybersecurity news helpful, consider supporting our work.

Buy Me a Coffee PayPal

Crypto

USDT (TRC20):

TN8BdV8cp4T1Cd28gK9qTAnZknzzuwyUtm Copy

USDT (ERC20):

0x3725e1a7d3bc5765499fa6aaafe307fabcd75bce Copy

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.