Use-after-free in Linux kernel - CVE-2026-64554

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in br_ip6_fragment() when processing crafted IPv6 packets on a cloned skb. A local user can send a specially crafted packet to cause a denial of service.

The issue results from dereferencing a stale prevhdr pointer after skb_checksum_help() reallocates the skb head, and the resulting write can trigger a kernel panic.

Affected software

How to mitigate CVE-2026-64554

External References

• https://git.kernel.org/stable/c/00c06ef8c018493943891a7d0ca82b71b24f3180
• https://git.kernel.org/stable/c/1c4f67c89fd27c4df4c70b135c2c59627698b3c0
• https://git.kernel.org/stable/c/2731efa6364e47934c96eb69e01ea131e8af8030
• https://git.kernel.org/stable/c/4ac981a8b7ce7aec99a52d08f8a8953e8e120067
• https://git.kernel.org/stable/c/86f3ce81dd2b4b0aa2c3016c989a943e4b1b643d
• https://git.kernel.org/stable/c/8c10778ec674b67a07ea042fcba64270f3f38a5a
• https://git.kernel.org/stable/c/c141f69d0a0fb16964dbc293650047e69bda8af7
• https://git.kernel.org/stable/c/f2e6596d10783557aeb9668da2a3b4d19deb2001

Related Security Bulletins

• Use-after-free in Linux kernel ipv6
• Debian update for linux