CVE-2026-64554

Received Received - Intake

Use-After-Free in Linux Kernel Netfilter Bridge

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-07-28

AI Q&A

2026-07-28

EPSS Evaluated

N/A

NVD

CVE-2026-64554

EUVD

EUVD-2026-49605

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's netfilter bridge module. It occurs when br_ip6_fragment() processes IPv6 fragments in bridged traffic. The function retrieves a pointer into the network packet header, then calls skb_checksum_help() which may reallocate the packet buffer. This leaves the pointer dangling, and later when ip6_frag_next() tries to use it, it causes a write-after-free memory corruption.

The vulnerability is triggered by sending specially crafted IPv6 packets through a Linux bridge with netfilter enabled. The exploit path involves packet handling through the bridge, netfilter hooks, and IPv6 fragmentation code.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter bridge module and requires kernel-level detection. Check if your kernel version includes the vulnerable code path by examining the br_ip6_fragment function in net/ipv6/netfilter.c. Look for kernel logs indicating slab-use-after-free errors in ip6_frag_next or br_ip6_fragment.

Impact Analysis

This vulnerability allows an attacker to cause a kernel panic leading to system crash or denial of service. In some cases it may enable privilege escalation if the attacker can execute arbitrary code in kernel context. Systems using Linux kernel versions with this vulnerability and running bridge networking with netfilter are affected.

Mitigation Strategies

Apply the kernel patch that fixes this issue by saving prevhdr's offset before skb_checksum_help() and recomputing it after. Update to a kernel version that includes the fix referenced as commit ef0efcd3bd3f. Alternatively, disable IPv6 fragmentation handling in the bridge module if not required.

Hi! I’m here to help you understand CVE-2026-64554. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70