Use-after-free in Linux kernel netfilter/nf_queue — NFQUEUE doesn’t reference the bridge master in skb->dev, so deleting the bridge mid-queue leaves it dangling and an ACCEPT verdict triggers UAF. Public unprivileged LPE-to-root PoC on Fedora 44 kernel 6.19.10-300. Upgrade to 7.0.11 for Fedora 44. Fixed version for linux kernel 5.10.259, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34.