CVE-2026-64554

This is a use-after-free vulnerability in the Linux kernel's IPv6 bridge fragmentation path. When an IPv6 packet traverses a Linux bridge with netfilter hooks active, the br_ip6_fragment() function obtains a raw pointer into the skb head buffer by calling ip6_find_1stfragopt(). The function then calls skb_checksum_help() on a cloned skb, which internally invokes pskb_expand_head() to reallocate the skb head region. This reallocation invalidates the previously obtained prevhdr pointer. The crash manifests later in ip6_frag_next() when dereferencing the stale pointer—KASAN reports a slab-use-after-free write at the frag_next boundary. The critical point: this exact vulnerability class was already fixed fourteen months prior in commit ef0efcd3dbd3f, which addressed an identical dangling-pointer-across-reallocation bug in the IPv6 output path. The bridge code path was written or modified after that fix without applying the same defensive pattern—save the offset, recompute the pointer after potential reallocation. Detection: examine br_ip6_fragment() in your kernel source for any raw pointers into skb->data retained across calls to skb_checksum_help() or pskb_expand_head(). The vulnerable pattern is obtaining a pointer via ip6_find_1stfragopt() or similar, then performing any operation that may clone and reallocate the skb head. If you cannot review source, monitor for KASAN splats in ip6_frag_next() on systems with IPv6 bridging and netfilter loaded. Mitigation: disable br_netfilter if IPv6 bridging is not required, or ensure your distribution has backported the fix. The trigger requires both IPv6 and netfilter active on a bridge interface—systems running IPv4-only bridges are not affected regardless of kernel version. The crash occurs in interrupt context, meaning this reliably triggers a kernel panic rather than a catchable exception. This makes it a high-severity denial-of-service vector against any host with the required configuration, regardless of the modest EPSS score.

Reviewed through automated stages and approved by a human before publication.