CVE-2026-64554: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64554 Overview

CVE-2026-64554 is a use-after-free vulnerability in the Linux kernel's netfilter bridge module. The flaw resides in the br_ip6_fragment() function within the IPv6 bridge fragmentation path. The function obtains a prevhdr pointer into the skb head via ip6_find_1stfragopt(), then calls skb_checksum_help(). For a cloned skb, skb_checksum_help() reallocates the head through pskb_expand_head(), leaving prevhdr dangling. The stale pointer is later dereferenced in ip6_frag_next(), producing a use-after-free write detected by KASAN.

Critical Impact
An adjacent-network attacker sending crafted IPv6 packets through a Linux bridge with netfilter can trigger a use-after-free write, leading to kernel memory corruption and potential code execution or denial of service.

Affected Products

Linux kernel with netfilter bridge (nf_conntrack_bridge) and IPv6 forwarding enabled
Multiple stable Linux kernel branches (see referenced patch commits)
Systems using Linux bridges to forward IPv6 traffic with connection tracking

Discovery Timeline

2026-07-27 - CVE-2026-64554 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64554

Vulnerability Analysis

The vulnerability is a kernel-mode use-after-free write triggered during IPv6 packet fragmentation on a bridged interface. When br_ip6_fragment() handles a cloned skb, the call to skb_checksum_help() can invoke pskb_expand_head(), which reallocates the socket buffer's head memory. Any pointer that referenced the previous head, including prevhdr obtained earlier from ip6_find_1stfragopt(), becomes dangling. The subsequent write in ip6_frag_next() at net/ipv6/ip6_output.c:857 targets freed memory. The KASAN trace shows the write path traversing nf_ct_bridge_post, nf_hook_slow, br_forward_finish, and br_handle_frame, ending with a kernel panic when the fault occurs in interrupt context.

Root Cause

The root cause is failure to refresh a pointer into the skb head after a function call that may reallocate that head. skb_checksum_help() internally calls pskb_expand_head() for cloned skbs, invalidating any cached pointer derived from the previous head. The br_ip6_fragment() code path did not save the offset of prevhdr before the checksum operation or recompute it afterwards, unlike the analogous fix applied in commit ef0efcd3bd3f ("ipv6: Fix dangling pointer when ipv6 fragment").

Attack Vector

Exploitation requires the ability to inject IPv6 traffic through a Linux bridge with netfilter connection tracking active on the bridge path. The attack vector is Adjacent Network, meaning an attacker on the same broadcast domain as the bridge can send crafted IPv6 packets designed to force the cloned-skb fragmentation path. No privileges or user interaction are required. The KASAN report references packet_sendmsg in the call trace, indicating raw-socket-crafted frames as a plausible trigger. The resulting kernel memory corruption can lead to denial of service or, with additional heap-shaping primitives, arbitrary kernel write.

No public proof-of-concept code has been verified for this CVE. See the referenced Kernel Patch c141f69d for the exact code change.

Detection Methods for CVE-2026-64554

Indicators of Compromise

Kernel panic messages referencing ip6_frag_next, br_ip6_fragment, or nf_ct_bridge_post in dmesg or /var/log/kern.log
KASAN slab-use-after-free reports in kernel logs on debug builds
Unexpected bridge interface resets or reboots on hosts forwarding IPv6 traffic
Anomalous IPv6 packet patterns with fragmentation and checksum offload triggers on bridge ports

Detection Strategies

Compare running kernel version (uname -r) against distribution advisories referencing the fix commits c141f69d, 00c06ef8, 1c4f67c8, 2731efa6, 4ac981a8, 86f3ce81, 8c10778e, and f2e6596d
Enable KASAN on test kernels to surface the use-after-free during fuzzing of the bridge netfilter path
Monitor for unexpected kernel oops or panic events on hosts acting as IPv6 bridges with nf_conntrack_bridge loaded
Inventory hosts with br_netfilter and IPv6 forwarding enabled to scope exposure

Monitoring Recommendations

Ship kernel logs and crash dumps to a centralized log platform and alert on KASAN, BUG:, and Kernel panic strings
Track nf_conntrack_bridge module load events and IPv6 forwarding state changes across the fleet
Correlate bridge host crashes with adjacent-network IPv6 traffic captures to identify attack traffic

How to Mitigate CVE-2026-64554

Immediate Actions Required

Apply the vendor kernel update containing the upstream fix that saves the prevhdr offset before skb_checksum_help() and recomputes the pointer afterwards
Prioritize patching hosts that bridge IPv6 traffic with nf_conntrack_bridge loaded, including virtualization hosts and container nodes
Restrict adjacent-network access to bridged segments where patching cannot be performed immediately

Patch Information

The fix is distributed across multiple stable kernel branches. Reference the following commits: Kernel Patch c141f69d, Kernel Patch 00c06ef8, Kernel Patch 1c4f67c8, Kernel Patch 2731efa6, Kernel Patch 4ac981a8, Kernel Patch 86f3ce81, Kernel Patch 8c10778e, and Kernel Patch f2e6596d. Consult your distribution's security tracker for the corresponding backported package.

Workarounds

Unload br_netfilter where bridge-level netfilter processing is not required for network policy
Disable IPv6 forwarding on bridges that do not need to carry IPv6 traffic by setting net.ipv6.conf.all.forwarding=0
Segment untrusted hosts off Layer 2 domains that traverse a Linux bridge until the kernel patch is deployed

bash

# Check whether the affected code path is active on the host
lsmod | grep -E 'br_netfilter|nf_conntrack_bridge'
sysctl net.bridge.bridge-nf-call-ip6tables
sysctl net.ipv6.conf.all.forwarding

# Temporary mitigation: disable bridge netfilter for IPv6
sysctl -w net.bridge.bridge-nf-call-ip6tables=0