CVE-2026-64554
netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment()
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt
INFO
Published Date :
July 27, 2026, 9:17 p.m.
Last Modified :
July 27, 2026, 9:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64554
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Save offset before skb_checksum_help().
- Recompute offset after skb_checksum_help().
- Apply the Linux kernel netfilter bridge fix.
- Update the Linux kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64554.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64554 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64554
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64554 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64554 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 27, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': '8c10778ec674b67a07ea042fcba64270f3f38a5a', 'versionType': 'git'}, {'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': '2731efa6364e47934c96eb69e01ea131e8af8030', 'versionType': 'git'}, {'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': '00c06ef8c018493943891a7d0ca82b71b24f3180', 'versionType': 'git'}, {'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': 'c141f69d0a0fb16964dbc293650047e69bda8af7', 'versionType': 'git'}, {'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': 'f2e6596d10783557aeb9668da2a3b4d19deb2001', 'versionType': 'git'}, {'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': '1c4f67c89fd27c4df4c70b135c2c59627698b3c0', 'versionType': 'git'}, {'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': '4ac981a8b7ce7aec99a52d08f8a8953e8e120067', 'versionType': 'git'}, {'status': 'affected', 'version': '764dd163ac922f8683b5bcd3007251ce7b26cd33', 'lessThan': '86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d', 'versionType': 'git'}], 'programFiles': ['net/ipv6/netfilter.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.3'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.261', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.212', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.178', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.145', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.97', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.40', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.5', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc4', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/netfilter.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb skb_checksum_help() reallocates the head via pskb_expand_head(), leaving prevhdr dangling. It is later dereferenced in ip6_frag_next(), causing a use-after-free write. Save prevhdr's offset before skb_checksum_help() and recompute it after, like commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment"). BUG: KASAN: slab-use-after-free in ip6_frag_next (net/ipv6/ip6_output.c:857) Write of size 1 at addr ffff888013ff5016 by task exploit/141 Call Trace: ... kasan_report (mm/kasan/report.c:595) ip6_frag_next (net/ipv6/ip6_output.c:857) br_ip6_fragment (net/ipv6/netfilter.c:212) nf_ct_bridge_post (net/bridge/netfilter/nf_conntrack_bridge.c:407) nf_hook_slow (net/netfilter/core.c:619) br_forward_finish (net/bridge/br_forward.c:66) __br_forward (net/bridge/br_forward.c:115) maybe_deliver (net/bridge/br_forward.c:191) br_flood (net/bridge/br_forward.c:245) br_handle_frame_finish (net/bridge/br_input.c:229) br_handle_frame (net/bridge/br_input.c:442) ... packet_sendmsg (net/packet/af_packet.c:3114) ... do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Added Reference https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180 Added Reference https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0 Added Reference https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030 Added Reference https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067 Added Reference https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d Added Reference https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a Added Reference https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7 Added Reference https://git.kernel.org/stable/c/f2e6596d10783557aeb9668da2a3b4d19deb2001