In the Linux kernel, the nf_queue subsystem can incorrectly retain a reference to a bridge device while a packet queued to NFQUEUE contains a fake destination address. When the kernel upgrades that fake destination to a real one, the bridge’s private fake routing table remains pinned. This causes the bridge device’s private data structures to stay allocated until the NFQUEUE entry is finally freed, leading to a memory/resource leak that can exhaust kernel memory or prevent proper bridge teardown, resulting in a denial of service. The weakness is an example of CWE‑825, an incomplete cleanup or resource leak scenario.

All Linux kernel releases that include the netfilter nf_queue and br_netfilter modules are potentially affected. The CPE string indicates that any active kernel lacking the recent patch that implements the documented fix may be vulnerable. No specific version list was supplied, so kernels using NFQUEUE with bridge routing should be evaluated for the presence of the bug.

A CVSS score of 7.8 is assigned to this vulnerability, indicating a high severity. The EPSS score is less than 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not listed in CISA KEV. The flaw requires that a packet carrying a bridge‑bound fake destination be routed through NFQUEUE, which is generally a local or privileged operation. The likely attack vector is inferred to be a local or privileged attacker able to generate such packets. The risk is moderate to high if the attacker can repeatedly trigger the leak, potentially exhausting kernel memory or causing bridge failures.