CVE-2026-64554 in Linux
Summary
by MITRE • 07/28/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write.
Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment").
BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
This vulnerability exists within the Linux kernel's netfilter subsystem, specifically in the bridge module's handling of IPv6 fragments. The issue manifests as a use-after-free write condition that occurs during packet processing when bridging IPv6 traffic through the netfilter framework. The flaw is rooted in how the br_ip6_fragment() function manages memory pointers during fragment processing, creating a scenario where a stale pointer reference persists after memory reallocation.
The technical mechanism behind this vulnerability involves the interaction between ip6_find_1stfragopt() and skb_checksum_help() functions within the bridge packet processing path. When ip6_find_1stfragopt() retrieves a pointer to the first fragment option within an skb (socket buffer) head, this pointer becomes invalid after subsequent calls to pskb_expand_head() performed by skb_checksum_help(). This memory expansion operation reallocates the socket buffer's head space, causing the original prevhdr pointer to become dangling. The vulnerability is classified under CWE-416 as a use-after-free error and aligns with ATT&CK technique T1059.005 for system service manipulation through kernel-level exploits.
The operational impact of this vulnerability extends beyond simple memory corruption, as it represents a critical security flaw that could enable privilege escalation or denial-of-service conditions. When the dangling pointer is later dereferenced in ip6_frag_next(), the kernel experiences a slab-use-after-free condition that triggers KASAN (Kernel Address Sanitizer) detection and ultimately results in kernel panic. This vulnerability specifically affects systems running Linux kernels with netfilter bridge functionality enabled, particularly those handling IPv6 traffic through bridged network interfaces.
The fix implemented addresses this issue by saving the offset of the prevhdr pointer before calling skb_checksum_help() and then recomputing the correct pointer value afterward, following a pattern established in commit ef0efcd3bd3f. This approach ensures that the pointer remains valid throughout the function execution lifecycle, preventing the use-after-free condition that would otherwise occur during subsequent fragment processing operations. The solution maintains the integrity of memory references while preserving the functional behavior of the IPv6 fragmentation handling within the bridge netfilter module.
This vulnerability demonstrates the complexity inherent in kernel-level memory management and the critical importance of pointer validity maintenance in concurrent systems. The fix exemplifies proper defensive programming practices for kernel development, specifically addressing scenarios where memory reallocation operations can invalidate previously obtained pointers. The issue highlights the need for careful consideration of memory management patterns in high-performance networking code where packet processing may involve multiple memory operations that could affect pointer validity. The vulnerability's detection through KASAN indicates the effectiveness of modern kernel debugging tools in identifying such subtle but critical race conditions in complex network subsystems.
The fix pattern implemented follows established kernel development practices for handling similar issues in IPv6 stack components, demonstrating consistency with other fixes within the Linux kernel codebase. This approach to maintaining pointer validity during memory expansion operations is crucial for preventing similar vulnerabilities across different network processing paths and reinforces the importance of proper pointer management in kernel space operations. The vulnerability serves as a reminder of the intricate dependencies between various kernel subsystems and the potential for seemingly isolated memory management issues to cascade into critical system failures.