Executive brief
A vulnerability was identified in the Linux kernel's networking component that handles IPv6 traffic on network bridges. An attacker could potentially exploit this flaw to cause a system crash (kernel panic) or execute unauthorized actions by sending specially crafted network packets. This affects the stability and availability of servers or network appliances running impacted versions of the Linux kernel.
Technical details
A use-after-free (UAF) vulnerability exists in the br_ip6_fragment() function within net/ipv6/netfilter.c. The function obtains a pointer (prevhdr) into the socket buffer (skb) head, but subsequently calls skb_checksum_help(). In cases involving cloned skbs, skb_checksum_help() may trigger pskb_expand_head(), which reallocates the buffer head and leaves the original prevhdr pointer dangling. A subsequent dereference of this stale pointer in ip6_frag_next() results in a UAF write. This can lead to a kernel panic or memory corruption. The fix involves saving the header offset and recomputing the pointer after the checksum operation.
Affected products
- Linux Linux Kernel 764dd163ac92 to 8c10778ec674b67a07ea042fcba64270f3f38a5a
Timeline
- 2026-07-08: disclosed: Vulnerability reported by Microsoft researchers.
- 2026-07-24: patched: Fixes committed to various stable kernel branches.
- 2026-07-27: advisory: CVE-2026-64554 published.
References
- https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180
- https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0
- https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030
- https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067
- https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d
- https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a
- https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7